Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is designing a web application dashboard for a smart home IoT system. The application needs to allow users to sign in using their email and password or their social identity provider. Once authenticated, the web application must securely download and upload user-specific configuration files directly from an Amazon S3 bucket. Additionally, the application must invoke backend REST API endpoints hosted on Amazon API Gateway, which should only be accessible to authenticated users.

Which Cognito configuration should the developer choose to satisfy these requirements with the least operational overhead?

  1. A
    Configure a Cognito Identity Pool to manage user registration, local password policies, and social provider integration. Secure the API Gateway REST API using an API Gateway Cognito Authorizer with the Identity Pool token, and access the S3 bucket using the same token.
  2. B
    Configure a Cognito User Pool for user authentication and federation. Configure an API Gateway Custom Lambda Authorizer that calls the Cognito Identity Pool credentials exchange API for every request, and use the returned IAM credentials to authorize the user.
  3. Configure a Cognito User Pool to handle registration, login, and social identity provider federation. Secure the API Gateway REST API with a Cognito Authorizer using the User Pool ID token. Configure a Cognito Identity Pool with the User Pool as an identity provider to obtain temporary AWS credentials for S3 access.Answer
  4. D
    Configure a Cognito User Pool to authenticate users. Store static IAM access keys and secret keys in the User Pool's custom user attributes, retrieve these attributes upon login, and use them to sign requests to API Gateway and S3.

Answer

Configure a Cognito User Pool to handle registration, login, and social identity provider federation. Secure the API Gateway REST API with a Cognito Authorizer using the User Pool ID token. Configure a Cognito Identity Pool with the User Pool as an identity provider to obtain temporary AWS credentials for S3 access.
The correct approach uses an Amazon Cognito User Pool to manage authentication (handling registration, local credentials, and social provider federation) and uses the resulting JSON Web Token (JWT) ID token to authorize API requests via the built-in API Gateway Cognito Authorizer. To access AWS resources like Amazon S3, a Cognito Identity Pool is required to exchange the User Pool tokens for temporary AWS IAM credentials.

Step-by-Step Solution

1
Select Cognito User Pools for user sign-in and management.
Users can register, sign in, and federate through social identity providers to receive JWT tokens.
Cognito User Pools serve as the user directory and handle the authentication flow.
2
Integrate API Gateway with the Cognito User Pool.
API Gateway uses a native Cognito Authorizer to validate incoming ID tokens directly.
This secures the REST API without requiring custom Lambda code or credentials exchange for API calls.
3
Configure a Cognito Identity Pool with the User Pool as a provider.
The client application exchanges the User Pool token for temporary AWS IAM credentials.
These temporary credentials allow the client application to directly and securely upload files to Amazon S3.

Key Concept

Distinction between Cognito User Pools (authentication and user directory) and Cognito Identity Pools (authorization and temporary AWS credentials exchange), as well as integrating User Pools with API Gateway Cognito Authorizers.
Estimated Time:1m 30s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic