Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is implementing a secure report retrieval feature for a corporate intranet portal. The portal's users authenticate using an Amazon Cognito User Pool. Once authenticated, the portal's client-side application needs to download private reports directly from an Amazon S3 bucket. To optimize performance and cost, the architecture must not route the file downloads through an intermediate API Gateway or Lambda function. The solution must grant users direct, short-lived access to the reports using the least privilege principle.

Which TWO configuration steps should the developer perform to meet these requirements?

  1. Configure an Amazon Cognito Identity Pool and add the Cognito User Pool as an identity provider.Answer
  2. Attach an IAM policy granting s3:GetObject permissions to the IAM role associated with authenticated users in the Identity Pool.Answer
  3. C
    Generate temporary AWS credentials by calling the AWS STS AssumeRole API directly from the client application using the Cognito User Pool ID token.
  4. D
    Configure an Amazon API Gateway endpoint with a Cognito User Pool authorizer to route S3 file downloads.
  5. E
    Create an IAM User for each Cognito User Pool user and store their access keys in the application client.

Answer

Configure an Amazon Cognito Identity Pool and add the Cognito User Pool as an identity provider, and attach an IAM policy granting s3:GetObject permissions to the IAM role associated with authenticated users in the Identity Pool.
To authorize authenticated Cognito User Pool users to directly access private S3 resources, the developer must configure an Amazon Cognito Identity Pool that lists the User Pool as its identity provider. The developer must then attach an IAM policy granting s3:GetObject permissions to the authenticated IAM role of the Identity Pool. This allows the client-side application to obtain short-lived AWS credentials containing the necessary permissions to retrieve files directly from S3 without passing through intermediate compute layers.

Step-by-Step Solution

1
Configure the identity directory
Ensure users authenticate via the Amazon Cognito User Pool, which validates credentials and issues JSON Web Tokens (JWTs).
Provides the initial authentication mechanism and user directory.
2
Set up federated authorization
Create an Amazon Cognito Identity Pool and register the Cognito User Pool ID/App Client ID as the identity provider.
Establishes a mechanism to exchange identity tokens (JWTs) for temporary AWS credentials.
3
Configure IAM permissions
Attach an IAM policy with s3:GetObject permission for the target S3 bucket to the Identity Pool's authenticated IAM role.
Ensures that the client application receives credentials authorized to retrieve reports directly from S3.

Key Concept

Amazon Cognito Authentication and Authorization using User Pools and Identity Pools
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic