Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is designing a serverless architecture for a report distribution application. The frontend is a Single Page Application (SPA) hosted on Amazon S3. The backend APIs are deployed using Amazon API Gateway. The developer needs to implement sign-up and sign-in functionality for users, secure the API Gateway endpoints, and allow the SPA to download reports directly from a private S3 bucket after authentication.

Which combination of actions should the developer take to meet these requirements securely? (Select TWO.)

  1. Create an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on the API Gateway REST API.Answer
  2. Create an Amazon Cognito Identity Pool, link it to the User Pool, and map users to an authenticated IAM role that allows reading from the private S3 bucket.Answer
  3. C
    Create an Amazon Cognito Identity Pool to manage user registration and directory services, and configure a built-in Cognito Authorizer on the API Gateway REST API.
  4. D
    Configure a custom Lambda Authorizer in API Gateway to generate and return temporary AWS credentials from the Cognito Identity Pool directly in the authorization response.
  5. E
    Create an IAM role with permissions to read from the private S3 bucket, and configure its trust policy to allow the API Gateway service principal to assume the role.

Answer

Create an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on the API Gateway REST API. Also, create an Amazon Cognito Identity Pool, link it to the User Pool, and map users to an authenticated IAM role that allows reading from the private S3 bucket.
To implement these requirements securely, the developer must use a Cognito User Pool to handle user authentication and registration. API Gateway integrates natively with Cognito User Pools using a built-in authorizer to validate the JWT tokens generated during login. For direct S3 access from the browser, Cognito Identity Pools (federated identities) should be used. The Identity Pool integrates with the User Pool as an identity provider and exchanges the User Pool tokens for temporary AWS credentials, which are mapped to an authenticated IAM role that grants permissions to the private S3 bucket.

Step-by-Step Solution

1
Identify the service required for user sign-up, sign-in, and directory management.
Amazon Cognito User Pools is chosen as the user directory.
Cognito User Pools handle authentication, user registration, and token generation.
2
Secure the Amazon API Gateway endpoints using the authenticated user identity.
Configure a Cognito User Pool Authorizer on API Gateway.
API Gateway can natively validate Cognito User Pool JWT tokens without custom Lambda code.
3
Determine the mechanism to allow the frontend SPA to download files directly from a private S3 bucket.
Use Amazon Cognito Identity Pools to exchange User Pool tokens for temporary AWS credentials associated with an IAM role.
Cognito Identity Pools provide temporary AWS credentials to federated or authenticated users for direct access to AWS resources like S3.

Key Concept

Using Cognito User Pools for authentication and API Gateway protection, combined with Cognito Identity Pools for temporary AWS credentials to access S3.
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic