A developer is designing a Single Page Application (SPA) that requires user authentication through external social identity providers (IdPs). Once authenticated, the SPA must perform two operations:
1. Make HTTP requests to a backend REST API hosted on Amazon API Gateway, which requires access control based on user group membership.
2. Upload user-profile images directly to an Amazon S3 bucket folder specific to each authenticated user (`s3://user-profiles-bucket/uploads/user-id/`).
The developer wants to implement a solution that minimizes custom backend code, maintains a native OAuth 2.0 flow, and adheres to the principle of least privilege.
Which combination of configuration steps meets these requirements?
- Configure a Cognito User Pool with the social IdPs and use the Authorization Code Flow with PKCE. Integrate API Gateway using a Cognito User Pool Authorizer. Configure a Cognito Identity Pool with the User Pool as the provider, and assign an authenticated IAM role with a policy allowing `s3:PutObject` on the S3 path using the `${cognito-identity.amazonaws.com:sub}` policy variable.Answer
- BConfigure a Cognito User Pool with the social IdPs. Create a custom API Gateway Lambda Authorizer to validate the token and perform custom group checks. Have the Lambda Authorizer call `sts:AssumeRole` on a role trusting API Gateway, and return the temporary credentials to the SPA to perform S3 uploads.
- CConfigure a Cognito Identity Pool to federate directly with the social IdPs, bypassing the Cognito User Pool. Use API Gateway with IAM Authorization. Assign an IAM role to the Identity Pool that allows `s3:PutObject` on the S3 path using the `${cognito-idp.amazonaws.com:sub}` policy variable.
- DConfigure a Cognito User Pool and a Cognito Identity Pool. Integrate API Gateway with a Cognito User Pool Authorizer. In the Cognito Identity Pool, configure the authenticated IAM role trust policy to trust the API Gateway service principal (`apigateway.amazonaws.com`) and configure the permission policy to allow `s3:PutObject` using the `${aws:username}` variable.
Answer
Configure a Cognito User Pool with the social IdPs and use the Authorization Code Flow with PKCE. Integrate API Gateway using a Cognito User Pool Authorizer. Configure a Cognito Identity Pool with the User Pool as the provider, and assign an authenticated IAM role with a policy allowing `s3:PutObject` on the S3 path using the `${cognito-identity.amazonaws.com:sub}` policy variable.
The correct solution uses a Cognito User Pool for user authentication (directory) with social IdPs and the OAuth 2.0 Authorization Code Flow with PKCE, which is the recommended flow for SPAs. API Gateway natively integrates with Cognito User Pools using a built-in Cognito User Pool Authorizer, which validates the JWT ID or access token without custom code. For S3 access, a Cognito Identity Pool is used to exchange the User Pool token for temporary AWS credentials. The IAM policy for the authenticated role uses the `${cognito-identity.amazonaws.com:sub}` context variable to restrict users to their own folders.
Step-by-Step Solution
Key Concept
Cognito User Pools manage user directory and authentication, while Cognito Identity Pools grant temporary AWS credentials to authenticated users. API Gateway integrates natively with User Pools using Cognito User Pool Authorizers.