Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is building a mobile application that allows employees to sign in using either their corporate SAML Identity Provider (IdP) or a local email-based account. Once authenticated, the application must download customized settings files directly from a private Amazon S3 bucket.

Which combination of Cognito resources and configurations is required to support this architecture? (Select TWO.)

  1. Configure an Amazon Cognito User Pool to manage user directories, local email authentication, and integration with the corporate SAML Identity Provider.Answer
  2. Configure an Amazon Cognito Identity Pool, register the User Pool as an authentication provider, and associate it with an IAM role that allows read access to the S3 bucket.Answer
  3. C
    Configure an Amazon Cognito Identity Pool to maintain the user directory, handle password verification, and store custom user attributes.
  4. D
    Configure an Amazon API Gateway Lambda Authorizer to validate the user credentials and exchange Cognito tokens for AWS credentials to allow direct S3 API calls.
  5. E
    Modify the trust policy of the S3-access IAM role to set the Principal to the Cognito User Pool's regional endpoint domain so that authenticated users can assume the role directly.

Answer

Configure an Amazon Cognito User Pool to manage user directories, local email authentication, and integration with the corporate SAML Identity Provider; and configure an Amazon Cognito Identity Pool, register the User Pool as an authentication provider, and associate it with an IAM role that allows read access to the S3 bucket.
The correct solution involves configuring an Amazon Cognito User Pool to handle authentication, user profile storage, and integration with the SAML Identity Provider, while using an Amazon Cognito Identity Pool to swap the resulting tokens for temporary, fine-grained AWS credentials that grant access to S3. This separation of duties utilizes User Pools for identity directory and Identity Pools for AWS resource authorization.

Step-by-Step Solution

1
Select the component for user directory management and federation.
Identify that an Amazon Cognito User Pool is designed for authentication, user directory management, and integrating with external identity providers (like SAML or OIDC).
This meets the requirement of allowing employees to sign in using corporate SAML or email-based local accounts.
2
Select the component for AWS resource access and credential generation.
Identify that an Amazon Cognito Identity Pool is required to translate the authenticated identity (from the User Pool) into temporary AWS credentials.
This allows the application to directly and securely download files from the private Amazon S3 bucket using standard AWS SDK calls.
3
Verify the configuration and trust relationship.
Ensure the Identity Pool is registered with the User Pool, and the associated IAM role trusts the Identity Pool service principal to avoid trust policy misconfiguration.
The IAM role must trust 'cognito-identity.amazonaws.com' via web identity federation to permit clients to assume it and retrieve credentials.

Key Concept

Separating authentication (User Pools) from authorization for AWS resources (Identity Pools) in Amazon Cognito.
Estimated Time:1m 30s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic