Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

A gaming company is developing a new multiplayer dashboard application. The application must authenticate users against an existing, on-premises legacy database containing user credentials without migrating user data to the cloud. Once authenticated, the client application must be able to query leaderboard data directly from an Amazon DynamoDB table and publish telemetry events directly to an Amazon Kinesis Data Stream. Which TWO actions should the developer take to meet these requirements?

  1. Configure an Amazon Cognito Identity Pool to support developer authenticated identities (developer provider name) and associate an IAM role for authenticated users with policies allowing access to DynamoDB and Kinesis.Answer
  2. Build a backend authentication service that validates the user's legacy credentials and calls the GetOpenIdTokenForDeveloperIdentity API to return a Cognito identity ID and an OpenID Connect token to the client.Answer
  3. C
    Create an Amazon Cognito User Pool with custom authentication triggers (Define Auth Challenge, Create Auth Challenge, and Verify Auth Challenge Response) to authenticate users against the legacy database, and pass the User Pool ID token directly to authorize client SDK requests to DynamoDB and Kinesis.
  4. D
    Create an API Gateway API with a custom Lambda Authorizer that queries the legacy database, validates credentials, and returns temporary IAM credentials by calling the AssumeRole API in STS directly to the client.
  5. E
    Configure an Amazon Cognito User Pool with a SAML 2.0 federation identity provider that syncs the on-premises database credentials via AWS Directory Service, and exchange the resulting SAML assertion directly for IAM credentials using an Identity Pool.

Answer

Configure an Amazon Cognito Identity Pool to support developer authenticated identities (developer provider name) and associate an IAM role for authenticated users with policies allowing access to DynamoDB and Kinesis; and build a backend authentication service that validates the user's legacy credentials and calls the GetOpenIdTokenForDeveloperIdentity API to return a Cognito identity ID and an OpenID Connect token to the client.
The correct options work in tandem to implement Developer Authenticated Identities. The developer-designed backend validates user credentials against the legacy database and uses the GetOpenIdTokenForDeveloperIdentity API to obtain an OpenID Connect token and Cognito identity ID. The client application then uses these to request temporary AWS credentials from the Cognito Identity Pool, which assumes the authenticated IAM role containing the necessary DynamoDB and Kinesis permissions.

Step-by-Step Solution

1
Implement a custom backend service that validates credentials against the legacy database.
The user is authenticated successfully within the company's existing on-premises authentication domain.
Since the legacy credentials cannot be migrated to the cloud, the validation must happen on a secure backend system controlled by the developer.
2
Use the backend service to invoke the Cognito GetOpenIdTokenForDeveloperIdentity API.
Cognito registers the developer-authenticated identity and returns a unique identity ID and an OpenID Connect (OIDC) token to the backend, which forwards them to the client.
This establishes a mapping between the custom user identity and an Amazon Cognito Identity Pool identifier.
3
Configure the Amazon Cognito Identity Pool to trust the developer provider name, and attach an authenticated IAM role with read/write access to DynamoDB and Kinesis.
The client application can call GetCredentialsForIdentity using the OIDC token to retrieve temporary, limited-privilege AWS credentials.
This enables the client application to query DynamoDB and publish to Kinesis directly without passing through a custom API proxy.

Key Concept

Cognito Developer Authenticated Identities (Developer Provider Flow)
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic