A developer is building a serverless backend where users must register and sign in to access private API Gateway endpoints. The developer wants to use built-in AWS features to authenticate users and control access to the APIs with minimal custom code.
Which TWO Amazon Cognito features or configurations should the developer implement to meet these requirements? (Select TWO.)
- An Amazon Cognito User Pool to manage user registration, sign-in, and token generation.Answer
- An Amazon Cognito Authorizer in API Gateway to validate the JSON Web Tokens (JWTs) returned after user authentication.Answer
- CAn Amazon Cognito Identity Pool to exchange user credentials for temporary AWS IAM credentials to access the API Gateway endpoints.
- DA custom Lambda Authorizer in API Gateway to manually parse and validate the tokens issued by Amazon Cognito.
- EAn Amazon Cognito User Pool configured to attach AWS IAM policies directly to user profiles for API Gateway access.
Answer
Implementing an Amazon Cognito User Pool and configuring an Amazon Cognito Authorizer in API Gateway
To authenticate users and authorize API Gateway requests with minimal overhead, a developer should use an Amazon Cognito User Pool to handle user directory services (registration and sign-in) and token issuance, and pair it with an API Gateway Cognito Authorizer to validate those tokens at the API entry point.
Step-by-Step Solution
Key Concept
Amazon Cognito User Pools provide authentication and issue tokens, while API Gateway Cognito Authorizers provide built-in token validation for authorization.