Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a serverless web application for a fitness tracking portal. The application must allow users to log in using their existing Google or Facebook accounts. Once authenticated, the application must allow users to retrieve their profile data from an Amazon API Gateway REST API and upload workout videos directly to a private Amazon S3 bucket. Which TWO configuration steps should the developer perform to implement this authentication and authorization workflow with the least operational overhead?

  1. Configure a Cognito User Pool with Google and Facebook social identity providers, and configure a Cognito Authorizer on the API Gateway REST API.Answer
  2. Configure a Cognito Identity Pool, set the Cognito User Pool as an authentication provider, and assign an authenticated IAM role with write permissions for the S3 bucket.Answer
  3. C
    Configure a Cognito User Pool with Google and Facebook, and associate an IAM role with the User Pool to generate temporary credentials for writing directly to the S3 bucket.
  4. D
    Configure a custom API Gateway Lambda Authorizer to validate the social identity provider tokens, and have it return temporary AWS credentials to the client for the S3 uploads.
  5. E
    Configure a custom API Gateway Lambda Authorizer to validate the Cognito Identity Pool token for the REST API endpoint.

Answer

Configure a Cognito User Pool with Google and Facebook social identity providers, configure a Cognito Authorizer on the API Gateway REST API, configure a Cognito Identity Pool using the User Pool as an authentication provider, and assign an authenticated IAM role with write permissions for the S3 bucket.
To implement authentication with Google and Facebook and access both API Gateway and S3 with the least operational overhead, the developer should combine a Cognito User Pool with a Cognito Identity Pool. The Cognito User Pool authenticates the federated social users and provides tokens. These tokens are natively validated by the API Gateway Cognito Authorizer to secure REST API endpoints without custom code. To allow direct upload to a private S3 bucket, the application must exchange the User Pool tokens for temporary AWS credentials using a Cognito Identity Pool, which maps the authenticated session to an IAM role with S3 write permissions.

Step-by-Step Solution

1
Set up User Directory and Social Federation
Configure an Amazon Cognito User Pool with Google and Facebook as identity providers to handle user registration, login, and identity token issuance.
A User Pool acts as the user directory and manages federation, allowing the application to authenticate users and receive JSON Web Tokens (JWTs) representing their identity.
2
Authorize API Access
Configure a Cognito Authorizer on the Amazon API Gateway REST API endpoints.
The Cognito Authorizer natively validates the identity tokens (JWTs) passed in the authorization header of incoming API requests, securing the backend with zero custom code.
3
Enable S3 Write Permissions
Create an Amazon Cognito Identity Pool, configure the User Pool as the authentication provider, and associate the authenticated IAM role with S3 write permissions.
An Identity Pool (Federated Identities) is required to exchange the authenticated User Pool token for temporary, short-lived AWS credentials, enabling the client application to directly upload video files to S3 without using a proxy backend.

Key Concept

Amazon Cognito Authentication and Authorization
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic