Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is designing a smart-home mobile application that allows authenticated users to read their device telemetry data directly from an Amazon DynamoDB table. The solution must minimize backend server management and allow the mobile app to make direct, secure SDK calls to DynamoDB using temporary AWS credentials, restricting users to only access their own data. Which architecture should the developer implement to meet these requirements?

  1. Configure an Amazon Cognito User Pool for user authentication and directory services, and an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials. Associate an IAM role with the Identity Pool that uses a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID.Answer
  2. B
    Configure an Amazon Cognito User Pool for user authentication. Have the mobile application send the User Pool ID token directly in the authorization header of the AWS SDK client to perform DynamoDB operations.
  3. C
    Configure an Amazon Cognito User Pool for user authentication. Set up Amazon API Gateway with a custom Lambda Authorizer that parses the JWT, validates it against the User Pool, and performs the DynamoDB operations directly within the authorizer function.
  4. D
    Configure an Amazon Cognito Identity Pool as the user directory to manage user sign-ups and logins. Configure the mobile application to use the Identity Pool credentials to access DynamoDB, relying on application-side logic to filter data access.

Answer

Configure an Amazon Cognito User Pool for user authentication and directory services, and an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials. Associate an IAM role with the Identity Pool that uses a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID.
The correct architecture uses Cognito User Pools to authenticate the users, and Cognito Identity Pools to exchange those tokens for temporary AWS credentials. By applying a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID on the IAM role assumed via the Identity Pool, the developer achieves direct, fine-grained access control to the DynamoDB table with minimal operational overhead.

Step-by-Step Solution

1
Determine the authentication and directory mechanism.
Implement an Amazon Cognito User Pool to act as the identity provider, managing user registration, sign-in, and authentication tokens.
User Pools are specifically designed for user directories, handling authentication, and generating JSON Web Tokens (JWTs).
2
Determine the authorization and credential retrieval mechanism.
Implement an Amazon Cognito Identity Pool, configuring the User Pool as an authentication provider.
Identity Pools are designed to exchange authentication tokens (such as User Pool JWTs) for temporary, limited-privilege AWS credentials needed for direct SDK calls.
3
Apply fine-grained access control in the authorized IAM role.
Attach a policy to the Identity Pool's authenticated IAM role with a dynamodb:LeadingKeys condition set to the user's Cognito identity ID.
Using the dynamodb:LeadingKeys condition ensures that the authenticated user is restricted to reading and writing items in the DynamoDB table where the partition key matches their unique Cognito identity ID.

Key Concept

Integration of Amazon Cognito User Pools and Identity Pools for direct, fine-grained access to AWS services.
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic