Examkin

Question

Difficulty: EasyAmazon Cognito Authentication and Authorization

A developer is building a mobile application that allows users to register, log in, and upload photos directly to a private Amazon S3 bucket. The developer wants to use Amazon Cognito for user management and secure access. Which TWO options represent the correct configuration of Amazon Cognito services required to meet these objectives?

  1. Amazon Cognito User Pools to handle user sign-up, sign-in, and authentication token issuanceAnswer
  2. Amazon Cognito Identity Pools to federate user identity and obtain temporary AWS credentials for Amazon S3 accessAnswer
  3. C
    Amazon Cognito User Pools to directly map users to IAM roles and issue temporary S3 credentials
  4. D
    Amazon API Gateway Lambda Authorizer to validate user credentials and return temporary IAM credentials to the client
  5. E
    Static IAM user access keys hardcoded in the application client to perform the S3 photo upload

Answer

Amazon Cognito User Pools are used to manage user authentication and token issuance, while Amazon Cognito Identity Pools are used to exchange these tokens for temporary AWS credentials to access AWS resources such as Amazon S3.
The correct options are the ones implementing Cognito User Pools for user authentication and directory management, and Cognito Identity Pools for exchanging the resulting tokens into temporary AWS credentials for S3 access.

Step-by-Step Solution

1
Identify the authentication requirement.
The application needs user registration, sign-in, and token management, which is handled by Amazon Cognito User Pools.
User Pools act as the user directory and provide identity management.
2
Identify the authorization requirement for AWS resources.
The application needs to grant authenticated users access to Amazon S3 to upload files.
Accessing AWS resources directly from client apps requires temporary credentials.
3
Determine the resource that yields temporary AWS credentials.
Amazon Cognito Identity Pools (Federated Identities) can take the token from the User Pool and exchange it for temporary AWS credentials via an IAM role.
Identity Pools are designed to authorize access to AWS resources.

Key Concept

The separation of concerns between Amazon Cognito User Pools (authentication/user directory) and Identity Pools (authorization/temporary credentials).
Estimated Time:1m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic