A shipping company is developing a web application that allows customers to track their cargo packages. The application must prompt users to register and log in to view their tracking history. After logging in, the client application must make authorized requests to a backend API hosted on Amazon API Gateway. The developer wants to use a standard, built-in solution to authenticate users and validate their login tokens without writing custom authentication code. Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)
- Configure an Amazon Cognito User Pool to handle user registration, authentication, and token generation.Answer
- Create a built-in Cognito User Pool Authorizer in Amazon API Gateway to validate the incoming tokens.Answer
- CConfigure an Amazon Cognito Identity Pool to authenticate the users and issue JSON Web Tokens (JWTs) to the client application.
- DDeploy a custom Amazon API Gateway Lambda Authorizer to decode and validate the tokens generated by Cognito.
- EModify the IAM trust policy of the backend API Gateway to trust the Cognito User Pool identity provider client.
Answer
The developer should configure an Amazon Cognito User Pool to handle user registration and authentication, and create a built-in Cognito User Pool Authorizer in Amazon API Gateway to validate the incoming tokens.
To fulfill the requirements, an Amazon Cognito User Pool must be used because it provides the user directory, sign-up, sign-in, and issues the JSON Web Tokens (JWTs) needed for authentication. Then, the API Gateway Cognito User Pool Authorizer should be used because it is the built-in, no-code mechanism to validate these tokens at the API gateway layer.
Step-by-Step Solution
Key Concept
Amazon Cognito User Pools vs. Identity Pools, and native API Gateway integration
Estimated Time:1m 0s