Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is designing a web application that uses Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for the backend. The API endpoints must be secured so that only users with an 'Active' subscription can access them. The subscription status is stored in an external Amazon DynamoDB table and updated in real-time, which prevents it from being stored as a static attribute in the Cognito ID or access tokens. Which solution should the developer implement to secure the API Gateway endpoints?

  1. A
    Implement a Cognito User Pool Authorizer on API Gateway, and configure a Cognito Post-Authentication Lambda trigger to query the DynamoDB table and dynamically inject the subscription status into the API Gateway authorizer context.
  2. B
    Implement a Cognito Identity Pool to exchange the User Pool token for temporary AWS credentials, and attach an IAM policy to the authenticated role that uses policy conditions to query the DynamoDB table in real-time.
  3. Implement an API Gateway Lambda Authorizer that validates the incoming Cognito token, queries the DynamoDB table to verify the user's subscription status, and returns an IAM policy to allow or deny the request.Answer
  4. D
    Implement a Cognito User Pool Authorizer on API Gateway, and configure API Gateway integration request mapping templates to query the DynamoDB table and reject unauthorized requests before they reach the backend.

Answer

Implement an API Gateway Lambda Authorizer that validates the incoming Cognito token, queries the DynamoDB table to verify the user's subscription status, and returns an IAM policy to allow or deny the request.
An API Gateway Lambda Authorizer allows custom authorization logic. In this scenario, it can parse and validate the Cognito token to authenticate the user, query DynamoDB to check the real-time subscription status, and dynamically generate an IAM policy that allows or denies access to the API resources.

Step-by-Step Solution

1
Analyze the authentication and authorization requirements.
Authentication is handled by Cognito User Pools (JWT tokens are provided to the client). Authorization requires a real-time check against an external DynamoDB table.
Determines whether the built-in Cognito Authorizer is sufficient or if a custom authorization mechanism is required.
2
Evaluate the capabilities of the native Cognito User Pool Authorizer.
The native authorizer can only validate token signatures, expiration, and audience. It cannot perform external lookups or query DynamoDB.
Eliminates solutions relying solely on the built-in Cognito User Pool Authorizer for dynamic database checks.
3
Select and configure an API Gateway Lambda Authorizer.
The Lambda Authorizer receives the token, decodes and validates it, queries DynamoDB for the real-time subscription status, and returns an IAM policy.
Provides the custom validation logic needed to satisfy the real-time subscription requirement before the request reaches the backend.

Key Concept

Using API Gateway Lambda Authorizers for custom, dynamic authorization checks that cannot be performed by built-in Cognito Authorizers.
Estimated Time:1m 30s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic