Security

390 questions

All types390 Multiple choice195 Multiple select195

A developer is deploying an application on Amazon ECS (Fargate) tasks within a private subnet of a VPC. The application must retrieve database credentials from AWS Secrets Manager and publish events to an Amazon SNS topic. The company's security policy mandates that all traffic to AWS services must remain within the AWS network and must not traverse the public internet.

Which combination of configurations will meet these requirements? (Select TWO.)

Select all that apply

Create Interface VPC Endpoints (AWS PrivateLink) for Secrets Manager and SNS in the private subnets, and ensure private DNS hostnames are enabled for the VPC.

Configure the security groups associated with the VPC endpoints to allow inbound traffic on port 443 from the security group of the ECS tasks.

Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to route traffic destined for Secrets Manager and SNS through the NAT Gateway.

Create Gateway VPC Endpoints for Secrets Manager and SNS, and add routes targeting these endpoints in the private subnet's route table.

Update the trust policy of the ECS task execution role to permit the VPC endpoint services to assume the role, granting them permission to route network traffic to the tasks.

Show answer & explanation

Answer: Create Interface VPC Endpoints (AWS PrivateLink) for Secrets Manager and SNS in the private subnets, and ensure private DNS hostnames are enabled for the VPC.; Configure the security groups associated with the VPC endpoints to allow inbound traffic on port 443 from the security group of the ECS tasks.

Answer

The correct configurations are to create Interface VPC Endpoints for Secrets Manager and SNS with private DNS hostnames enabled, and to configure the security groups on the VPC endpoints to allow inbound traffic on port 443 from the ECS tasks' security group.

To connect ECS tasks in a private subnet securely to AWS services (Secrets Manager and SNS) without traversing the public internet, the developer must use Interface VPC Endpoints (AWS PrivateLink). Private DNS hostnames must be enabled so that standard SDK calls to these services resolve to the private endpoint interfaces. Additionally, because Interface VPC Endpoints use ENIs with security groups, the endpoint security groups must be configured to allow inbound traffic on port 443 (HTTPS) from the ECS tasks' security group.

Step-by-Step Solution

Determine the type of VPC endpoint required for Secrets Manager and SNS.

Both AWS Secrets Manager and Amazon SNS require Interface VPC Endpoints (AWS PrivateLink), as Gateway VPC Endpoints are only available for Amazon S3 and Amazon DynamoDB.

This establishes the basic network architecture needed to access these services without using a public internet path.

Configure private resolution for the service endpoints within the VPC.

Enable private DNS hostnames for the created Interface VPC Endpoints in the VPC settings.

This ensures that DNS queries for the service endpoints (e.g., secretsmanager.us-east-1.amazonaws.com) resolve to the private IP addresses of the endpoint ENIs rather than their public IPs, preventing application code modifications.

Configure network security rules (security groups) to permit communication.

Allow inbound traffic on port 443 in the VPC endpoint security groups originating from the ECS tasks' security group, and ensure the ECS tasks' security group allows outbound traffic to the endpoints on port 443.

Interface VPC Endpoints are stateful and use security groups to filter incoming traffic. Since they expose resources over HTTPS, traffic must be allowed on port 443.

Key Concept

Establishing secure, private connections from resources in a private VPC subnet to AWS services using AWS PrivateLink (Interface VPC Endpoints) and proper security group configurations.

Estimated Time:1m 30s

Question 202Question →

A developer is deploying a backend application on Amazon ECS (Fargate) within a custom VPC. The application tasks are placed in private subnets and must connect to an Amazon ElastiCache for Redis cluster located in dedicated isolated subnets within the same VPC. Additionally, the application must fetch runtime API keys from AWS Secrets Manager and send transaction data to a third-party payment processing API on the public internet. Which combination of configurations will securely enable these connections while adhering to the principle of least privilege? (Select TWO.)

Select all that apply

Configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group, and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group.

Deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.

Configure an Interface VPC Endpoint in the private subnets to route traffic directly to the third-party payment processing API, and add an inbound security group rule on the ECS tasks to allow return traffic on port 443.

Configure the ECS tasks' security group with an inbound rule allowing TCP traffic on port 6379 from the ElastiCache security group to allow return cache traffic, and configure the private subnets' Network ACL to be stateful to track outbound connection responses.

Store the third-party API keys in AWS Systems Manager Parameter Store with automatic rotation configured, and route both Secrets Manager and payment API requests through a NAT Gateway deployed in the isolated subnet.

Show answer & explanation

Answer: Configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group, and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group.; Deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.

Answer

The correct configurations are to configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group, and deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.

The correct configurations involve using stateful security group rules to authorize outbound traffic from the ECS tasks' security group to the ElastiCache security group on port 6379, while allowing inbound traffic on the ElastiCache security group from the ECS tasks. To access the public internet, a NAT Gateway must be deployed in a public subnet with a corresponding route in the private subnets' route table. To securely access AWS Secrets Manager without using the public internet, an Interface VPC Endpoint should be created inside the private subnets.

Step-by-Step Solution

Configure internal database connectivity using security groups.

ECS tasks are permitted to initiate TCP connections to the ElastiCache cluster on port 6379, and the ElastiCache cluster permits inbound connections only from the ECS tasks' security group. Because security groups are stateful, return traffic is automatically handled without extra inbound rules.

Ensures secure, restricted database access within the VPC without exposing databases to broader subnet traffic.

Configure public internet routing for the external API.

A NAT Gateway is deployed in a public subnet, and the private subnet routing table is updated with a route pointing 0.0.0.0/0 to the NAT Gateway. This allows tasks in the private subnet to securely initiate outbound HTTPS connections to the payment gateway.

Private subnets do not have direct internet access; routing traffic through a NAT Gateway in a public subnet is required.

Establish secure private access to AWS Secrets Manager.

An Interface VPC Endpoint (AWS PrivateLink) is provisioned inside the private subnets for Secrets Manager. The application resolves the Secrets Manager DNS to private IP addresses.

Allows the application to fetch sensitive secrets without sending API requests over the public internet, reducing exposure.

Key Concept

VPC security controls require coordinating stateful security groups for internal resources, stateless routing via NAT Gateways for internet access, and VPC Endpoints for private AWS service communication.

Estimated Time:2m 0s

Question 203Question →

A developer is building a client-side utility in Python using the Boto3 SDK to encrypt database export files, each averaging $45\text{ MB}$ in size, before archiving them to an Amazon S3 bucket. The compliance policy requires the use of client-side envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS. Which of the following SDK workflows represents the correct and most efficient implementation for encrypting each file?

Call the KMS `generate_data_key` API to retrieve both a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, immediately delete the plaintext data key from memory, and store the encrypted file alongside the encrypted data key.

Call the KMS `generate_data_key_without_plaintext` API to retrieve the encrypted data key. Use the encrypted data key to encrypt the file locally, and store the encrypted file along with the encrypted data key.

Divide the file into chunks smaller than

4\text{ KB}

each. For each chunk, call the KMS `encrypt` API directly using the Customer Managed Key, concatenate the ciphertexts, and upload the final consolidated file.

Call the Systems Manager Parameter Store to retrieve the plaintext key material of the Customer Managed Key. Use this key material to encrypt the file locally, and upload the encrypted file.

Show answer & explanation

Answer: Call the KMS `generate_data_key` API to retrieve both a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, immediately delete the plaintext data key from memory, and store the encrypted file alongside the encrypted data key.

Answer

The correct implementation is to call the KMS `generate_data_key` API using the Customer Managed Key ID. KMS returns both the plaintext data key and the ciphertext (encrypted) data key. The application uses the plaintext key to encrypt the large file locally (client-side) using an algorithm like AES-256, deletes the plaintext key from memory to maintain security, and stores the encrypted data key alongside the encrypted file (often as S3 metadata) so it can be sent to KMS for decryption later.

Step-by-Step Solution

Request a data key from AWS KMS.

Receive a payload containing both the plaintext data key and the encrypted version of that key.

The plaintext key is required for local encryption, and the encrypted key is required for future decryption.

Encrypt the file locally using a symmetric encryption algorithm (e.g., AES-256) with the plaintext data key.

Generate the encrypted file payload.

Using the data key allows the encryption to happen locally, avoiding the

4\text{ KB}

limit of KMS direct encryption.

Secure the keys by deleting the plaintext data key from memory and keeping the encrypted data key.

The plaintext key is discarded, and the encrypted data key is kept.

Leaving the plaintext key in memory or writing it to disk is a security risk. The encrypted data key can only be decrypted by KMS.

Upload the encrypted file and the encrypted data key together to Amazon S3.

The ciphertext and metadata are stored in S3.

When decrypting, the client will retrieve the encrypted data key from S3 and pass it to KMS to get the plaintext key back.

Key Concept

AWS KMS Client-Side Envelope Encryption Workflow

Estimated Time:2m 30s

Question 204Question →

A developer is writing a Python application to secure sensitive application configuration files locally before uploading them to Amazon S3. The compliance policy requires the developer to use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key. Which two actions must the developer perform to implement this encryption workflow? (Select TWO.)

Select all that apply

Call the KMS GenerateDataKey API, passing the KMS key ID, to retrieve both a plaintext data key and an encrypted data key.

Use the plaintext data key to encrypt the files locally using a symmetric encryption algorithm.

Call the KMS GenerateDataKeyWithoutPlaintext API to obtain an encrypted data key, and use the encrypted data key to encrypt the files locally.

Call the KMS Encrypt API directly for each configuration file, passing the raw file contents to be encrypted by AWS KMS.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to be accessed later during decryption.

Show answer & explanation

Answer: Call the KMS GenerateDataKey API, passing the KMS key ID, to retrieve both a plaintext data key and an encrypted data key.; Use the plaintext data key to encrypt the files locally using a symmetric encryption algorithm.

Answer

The developer must call the KMS GenerateDataKey API to obtain the plaintext and encrypted data keys, and use the plaintext data key to encrypt the files locally.

In client-side envelope encryption, the application calls the GenerateDataKey API to obtain both a plaintext data key and an encrypted version of that key. The application uses the plaintext key to encrypt the files locally, and then discards the plaintext key from memory. The encrypted data key is stored alongside the encrypted data.

Step-by-Step Solution

Request a data key from AWS KMS.

The application receives a plaintext data key and an encrypted data key (ciphertext key) from the GenerateDataKey API call.

The plaintext key is required for local encryption, and the encrypted key is required for future decryption.

Encrypt the files locally.

The configuration files are encrypted using a symmetric encryption library (e.g., cryptography in Python) with the plaintext data key.

Envelope encryption requires the actual data to be encrypted client-side using the local plaintext data key.

Discard the plaintext key and store the encrypted key.

The plaintext data key is deleted from memory, and the encrypted data key is uploaded to Amazon S3 alongside the encrypted files.

Deleting the plaintext key ensures security, while storing the encrypted key allows authorization checks and decryption when retrieved.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 205Question →

A development team needs to store a collection of third-party API keys that will be accessed by several serverless applications. These keys must be encrypted at rest, but they do not require automatic rotation or cross-account access. The team wants a solution that minimizes storage and retrieval costs.

Which AWS service or feature should the developer select to store these API keys?

Systems Manager Parameter Store using SecureString parameters

AWS Secrets Manager

Hardcoding the API keys directly within the Lambda function client initialization code

Storing the API keys as plaintext in Systems Manager Parameter Store using String parameters

Show answer & explanation

Answer: Systems Manager Parameter Store using SecureString parameters

Answer

Systems Manager Parameter Store using SecureString parameters

Systems Manager Parameter Store using SecureString parameters is the correct choice because it provides secure, encrypted storage for configuration data and secrets at no additional cost for standard parameters. Since the API keys do not require automatic rotation or cross-account access, using Parameter Store is the most cost-effective and operationally efficient solution.

Step-by-Step Solution

Analyze the requirements for storing the third-party API keys.

The API keys must be encrypted at rest, accessed by multiple serverless applications, do not require automatic rotation, and the solution must minimize storage and retrieval costs.

Understanding the technical constraints helps in selecting the most cost-effective and secure AWS service.

Compare AWS Systems Manager Parameter Store and AWS Secrets Manager against the requirements.

Parameter Store (SecureString) offers free/cost-effective secure storage without automatic rotation. Secrets Manager supports automatic rotation but introduces a monthly cost per secret.

Both services support encryption, but Parameter Store is the more cost-effective choice for secrets that do not require rotation.

Select the correct service and parameter type.

Systems Manager Parameter Store using SecureString parameters satisfies both the security and cost-efficiency requirements.

Using SecureString parameters ensures the API keys are encrypted at rest using KMS while remaining cost-effective.

Key Concept

Selecting between Parameter Store and Secrets Manager based on rotation requirements and cost efficiency.

Estimated Time:1m 0s

Question 206Question →

A developer is designing a microservice application deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservice requires access to two types of data: database credentials for an Amazon RDS for PostgreSQL instance that must be automatically rotated every 30 days, and non-sensitive API endpoints for external integration that vary by environment. Which combination of actions should the developer take to store and manage this data securely and cost-effectively? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.

Store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.

Store the database credentials in AWS Systems Manager Parameter Store as SecureString parameters, and configure an Amazon EventBridge rule to trigger a custom Lambda function to rotate the credentials.

Store the non-sensitive API endpoints in AWS Secrets Manager to centralize all application configuration and enable automatic rotation.

Hardcode the database credentials in the application's source code and use the AWS SDK to decrypt them at runtime using a customer managed key in AWS KMS.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.; Store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.

Answer

Store the database credentials in AWS Secrets Manager with built-in automatic rotation, and store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.

Storing database credentials in AWS Secrets Manager takes advantage of native automatic rotation with Amazon RDS, removing the need to manage custom rotation code. Storing non-sensitive configuration parameters like API endpoints in AWS Systems Manager Parameter Store as String parameters is cost-effective because Parameter Store standard parameters are free, whereas Secrets Manager charges per secret.

Step-by-Step Solution

Evaluate the security and rotation requirements for the database credentials.

Identify that database credentials are highly sensitive and need to be rotated automatically every 30 days.

AWS Secrets Manager is the optimal service because it has built-in integration with Amazon RDS to rotate credentials automatically via a pre-configured Lambda function.

Evaluate the requirement for the non-sensitive API endpoints.

Identify that API endpoints are non-sensitive and vary by environment, meaning they do not require encryption or automatic rotation.

AWS Systems Manager Parameter Store String parameters are free of charge for standard use cases, making it the most cost-effective solution for non-sensitive configurations.

Identify the correct combination of options based on AWS best practices.

Select Secrets Manager for the database secret rotation and Parameter Store String parameters for the non-sensitive configuration data.

This combination fulfills all security requirements while optimizing costs.

Key Concept

Differentiating between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation, and cost requirements.

Estimated Time:2m 0s

Question 207Question →

A developer creates a customer managed key in AWS KMS to encrypt sensitive configuration payloads. The developer then attaches an IAM policy to an IAM role associated with an Amazon EC2 instance. The IAM policy grants permission for the `kms:Decrypt` action on the key's Amazon Resource Name (ARN). However, when the application running on the EC2 instance attempts to call the Decrypt API, it receives an `AccessDeniedException`. Which of the following is the most likely cause of this authorization failure?

The key policy for the customer managed key does not contain a statement that delegates permissions to the AWS account, which is required for IAM policies to grant access to the key.

The developer needs to configure a trust policy on the KMS key itself that explicitly lists the IAM role of the EC2 instance as a trusted entity.

The payload being decrypted is stored in Systems Manager Parameter Store as a SecureString parameter, which ignores KMS key policies and relies solely on Parameter Store policies.

The application must perform client-side envelope encryption locally to decrypt the ciphertext, which bypasses the need for the `kms:Decrypt` API call.

Show answer & explanation

Answer: The key policy for the customer managed key does not contain a statement that delegates permissions to the AWS account, which is required for IAM policies to grant access to the key.

Answer

The key policy for the customer managed key does not contain a statement that delegates permissions to the AWS account, which is required for IAM policies to grant access to the key.

For customer managed keys, AWS KMS evaluates both the key policy and the IAM policies. For an IAM policy to successfully grant access, the KMS key policy must contain a statement that delegates permission to the AWS account (specifically referencing the account's root principal ARN). If this delegation is missing, IAM policy permissions on the key are ignored, resulting in an AccessDeniedException.

Step-by-Step Solution

Analyze the IAM policy and the error.

The IAM policy grants the necessary `kms:Decrypt` permissions to the EC2 instance's IAM role, but the application still receives an `AccessDeniedException`.

AWS KMS evaluation logic requires checks on both the key policy and IAM policies.

Review the evaluation logic for AWS KMS customer managed keys.

Unlike other AWS services where IAM policies alone can grant access, KMS requires the key policy to explicitly delegate permission to the AWS account (via the root principal ARN) or directly to the IAM role.

If the key policy does not delegate permission to the AWS account, any permissions granted in IAM policies are ignored.

Identify the correct resolution.

Add a statement in the KMS key policy that allows the root principal of the AWS account to perform actions, thereby enabling IAM policies to govern access to the key.

This establishes the delegation chain from the key policy to IAM policies.

Key Concept

AWS KMS Key Policies and IAM Policy Integration

Question 208Question →

An enterprise retail application exposes catalog and inventory management endpoints via an Amazon API Gateway REST API. The system has two distinct integration requirements:

1. A customer-facing portal where users authenticate using external Google Workspace accounts.
2. An automated background synchronization service running on Amazon ECS Fargate that updates inventory levels.

The developer needs to secure both sets of endpoints using native AWS mechanisms to minimize custom code and maintenance.

Which TWO configuration steps should the developer perform to secure these endpoints?

Select all that apply

Configure the customer-facing endpoints to use an Amazon Cognito User Pool authorizer, allowing the API to automatically validate the JSON Web Tokens (JWT) generated after Google Workspace federation.

Enable AWS_IAM authorization on the inventory synchronization endpoints, and configure the ECS Fargate tasks with an IAM Task Role that has permissions to execute the API using Signature Version 4 signing.

Configure the customer-facing endpoints to use an Amazon Cognito Identity Pool authorizer, enabling users to present their Google Workspace credentials directly to API Gateway for authentication.

Build a custom Lambda authorizer for the inventory synchronization endpoints that validates the ECS Fargate container credentials by invoking the AWS Security Token Service (STS) on each API call.

Implement a Lambda proxy integration on the inventory synchronization endpoints, routing the requests to a backend Lambda function that manually parses and validates the AWS Signature Version 4 signature in the request headers.

Show answer & explanation

Answer: Configure the customer-facing endpoints to use an Amazon Cognito User Pool authorizer, allowing the API to automatically validate the JSON Web Tokens (JWT) generated after Google Workspace federation.; Enable AWS_IAM authorization on the inventory synchronization endpoints, and configure the ECS Fargate tasks with an IAM Task Role that has permissions to execute the API using Signature Version 4 signing.

Answer

Configure the customer-facing endpoints to use an Amazon Cognito User Pool authorizer, and enable AWS_IAM authorization on the inventory synchronization endpoints while assigning an IAM Task Role to the ECS Fargate tasks.

For external user authentication, Amazon Cognito User Pools provide a native authorizer in API Gateway that validates OIDC-compliant JWT tokens (such as from Google Workspace) without requiring custom Lambda code. For AWS service-to-service communication, enabling AWS_IAM authorization allows API Gateway to natively verify Signature Version 4 (SigV4) signatures generated by Fargate tasks using their IAM Task Roles, enforcing least-privilege access.

Step-by-Step Solution

Determine authorization for external federated users.

Identify that Google Workspace acts as the identity provider (IdP). Amazon Cognito User Pools handle federation and issue JWTs. API Gateway natively validates these JWTs via a Cognito User Pools authorizer.

This offloads identity management and token verification to AWS native services, avoiding custom validation code.

Determine authorization for internal AWS compute resources.

Identify that Amazon ECS Fargate runs within AWS. Secure service-to-service authentication is natively supported using AWS_IAM authorization and Signature Version 4 (SigV4) signing via an IAM Task Role.

This follows the security principle of least privilege and avoids managing static keys or custom authorizer logic.

Key Concept

API Gateway natively supports Amazon Cognito User Pools authorizers for user-based JWT validation and AWS_IAM authorization for service-to-service SigV4 request verification.

Estimated Time:2m 0s

Question 209Question →

An application developer is implementing a Lambda function that validates user sessions. The function must query a Redis cluster running in the private subnets of a custom VPC. At the same time, the function needs to send validation logs to an external analytics provider's HTTPS endpoint on the public internet. How should the developer configure the VPC network paths to allow the Lambda function to access both the private Redis cluster and the public HTTPS endpoint?

Associate the Lambda function with the private subnets of the VPC. Do not provision a NAT Gateway, since Lambda functions run in a managed service environment and automatically route internet-bound API requests through the default AWS internet gateway.

Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs

0.0.0.0/0

traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.

Deploy the Lambda function outside the VPC to maintain internet access. Store the Redis connection strings in AWS Systems Manager Parameter Store, and enable the Parameter Store native automatic rotation feature to securely rotate the Redis credentials without exposing them to the internet.

Place the Lambda function in the private subnets of the VPC. Modify the Lambda execution role's trust policy to trust the VPC's Elastic Network Interface (ENI), allowing it to bypass security groups and route traffic directly to the external HTTPS endpoint.

Show answer & explanation

Answer: Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs $0.0.0.0/0$ traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.

Answer

Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs

0.0.0.0/0

traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.

The correct answer provides the standard, secure pattern for accessing both private VPC resources and the public internet from an AWS Lambda function. By associating the Lambda function with the private subnets, it can reach the Redis cluster. By routing outbound internet traffic (

0.0.0.0/0

) from the private subnets through a NAT Gateway in a public subnet, the function can safely establish HTTPS connections to the public analytics API.

Step-by-Step Solution

Determine private connectivity requirements

To access the Redis cluster inside the private subnets, the Lambda function must be configured with VPC integration and attached to the same VPC and private subnets.

VPC integration allows the Lambda function to access resources in private subnets via Elastic Network Interfaces (ENIs) deployed in those subnets.

Determine public connectivity requirements

A NAT Gateway must be provisioned in a public subnet, and the route table for the private subnets must direct all internet-bound traffic (

0.0.0.0/0

) to this NAT Gateway.

Lambda functions with VPC integration lose access to the public internet by default because ENIs in private subnets do not have public IP addresses.

Configure security group rules

Allow inbound traffic on the Redis port from the Lambda function's security group.

VPC security groups act as stateful firewalls and must explicitly permit the inbound traffic to the Redis cluster.

Key Concept

A Lambda function configured to access resources within a private VPC subnet requires a NAT Gateway or VPC Endpoint to communicate with any endpoints on the public internet.

Question 210Question →

A developer is designing a security solution for a document archiving system. The application must encrypt PDF documents, each averaging $18\text{ MB}$ in size, before uploading them to an Amazon S3 bucket. A Customer Managed Key (CMK) in AWS KMS will be used to protect the data. A separate reader application running on Amazon ECS must download these documents from S3 and decrypt them. Which TWO actions must the developer perform to implement this workflow using the AWS SDK and AWS KMS under the principle of least privilege?

Select all that apply

In the writer application, call the KMS GenerateDataKey API operation to retrieve both a plaintext data key and a ciphertext data key. Encrypt the PDF file locally using the plaintext data key, delete the plaintext key from memory, and upload the encrypted PDF along with the ciphertext data key to Amazon S3.

In the reader application's IAM policy, grant the kms:Decrypt permission on the KMS CMK. Download the encrypted PDF and the ciphertext data key from Amazon S3, call the KMS Decrypt API operation with the ciphertext data key to retrieve the plaintext data key, and decrypt the PDF locally.

In the writer application, call the KMS Encrypt API operation directly, passing the PDF payload and the KMS CMK ARN to perform server-side encryption before uploading the encrypted bytes to Amazon S3.

In the writer application's IAM policy, grant the kms:Encrypt permission on the KMS CMK. Call the KMS GenerateDataKeyWithoutPlaintext API operation to obtain the ciphertext data key, call the KMS Decrypt API operation to retrieve the plaintext key for local encryption, and store the file in S3.

In the reader application's IAM policy, grant the kms:GenerateDataKey and kms:ReEncrypt permissions on the KMS CMK. Download the encrypted PDF and use the KMS ReEncrypt API operation to decrypt the file locally.

Show answer & explanation

Answer: In the writer application, call the KMS GenerateDataKey API operation to retrieve both a plaintext data key and a ciphertext data key. Encrypt the PDF file locally using the plaintext data key, delete the plaintext key from memory, and upload the encrypted PDF along with the ciphertext data key to Amazon S3.; In the reader application's IAM policy, grant the kms:Decrypt permission on the KMS CMK. Download the encrypted PDF and the ciphertext data key from Amazon S3, call the KMS Decrypt API operation with the ciphertext data key to retrieve the plaintext data key, and decrypt the PDF locally.

Answer

The developer must configure the writer application to call the KMS GenerateDataKey API operation to retrieve the plaintext and ciphertext data keys, encrypt the file locally, and delete the plaintext key from memory. Additionally, the developer must grant the reader application's IAM role the kms:Decrypt permission to decrypt the ciphertext data key via the KMS Decrypt API operation to retrieve the plaintext data key.

To encrypt payloads larger than

4\text{ KB}

like the

18\text{ MB}

PDFs, client-side envelope encryption must be used. The writer calls GenerateDataKey on the Customer Managed Key (CMK), getting both plaintext and ciphertext versions of the data key. It encrypts the PDF locally with the plaintext data key and then discards it. The ciphertext data key is saved alongside the encrypted file in S3. The reader downloads the encrypted PDF and the ciphertext data key, calls Decrypt to retrieve the plaintext data key, and then decrypts the PDF locally. Under the principle of least privilege, the reader only needs kms:Decrypt permission.

Step-by-Step Solution

Evaluate the file size against AWS KMS limitations.

Since the average PDF file size is

18\text{ MB}

and the direct KMS Encrypt API maximum limit is

4\text{ KB}

, the developer must use client-side envelope encryption.

Direct KMS encryption cannot handle large payloads, necessitating the generation of local data keys.

Determine the proper writer application API calls and IAM permissions.

The writer application must call GenerateDataKey (which requires kms:GenerateDataKey permission) to get both plaintext and ciphertext data keys, encrypt the payload with the plaintext key, delete the plaintext key, and store the ciphertext key with the encrypted file.

This implements standard client-side envelope encryption and minimizes key exposure.

Determine the proper reader application API calls and IAM permissions.

The reader application must download the encrypted PDF and the ciphertext key, call the Decrypt API (requiring kms:Decrypt permission) to decrypt the ciphertext key, and then decrypt the PDF locally.

To decrypt, only the ciphertext data key needs to be decrypted via KMS. The main document decryption happens locally.

Key Concept

Client-side envelope encryption with AWS KMS

Estimated Time:2m 0s

Question 211Question →

A developer needs to encrypt a database password of size $2\text{ KB}$ directly using an AWS Key Management Service (AWS KMS) key. Which AWS KMS API operation should the developer call to encrypt this payload?

GenerateDataKey

PutParameter

Encrypt

GenerateDataKeyWithoutPlaintext

Show answer & explanation

Answer: Encrypt

Answer

Encrypt

The Encrypt API operation is designed to encrypt small payloads (up to

4\text{ KiB}

) directly using a specified customer managed key or AWS managed key. Since the database password size is

2\text{ KB}

, it fits within this limit and can be encrypted directly in a single API call.

Step-by-Step Solution

Determine the size of the payload to be encrypted.

The payload is

2\text{ KB}

, which is under the

4\text{ KiB}

limit for direct encryption in AWS KMS.

AWS KMS allows direct encryption of small payloads up to

4\text{ KiB}

without requiring client-side envelope encryption.

Select the correct AWS KMS API operation that accepts a small plaintext payload and returns the ciphertext.

The Encrypt API operation is selected.

Calling Encrypt directly sends the plaintext payload to AWS KMS to be encrypted by the designated KMS key, returning the ciphertext.

Key Concept

Direct encryption of small payloads using the AWS KMS Encrypt API

Estimated Time:45s

Question 212Question →

To support file uploads in a new collaborative web portal, users must be able to sign up, sign in, and directly upload files to a private Amazon S3 bucket. The application needs to authenticate users and then obtain temporary AWS credentials for the uploads. Which TWO Amazon Cognito components should the developer implement to meet these requirements?

Select all that apply

A User Pool to manage user registration, sign-in, and provide a user directory.

An Identity Pool to exchange authentication tokens for temporary AWS credentials to access Amazon S3.

An IAM user with programmatic access keys stored directly in the web application's frontend code.

An API Gateway Lambda Authorizer to generate AWS credentials for S3 uploads.

An Identity Pool to store user profiles, passwords, and handle email verification workflows.

Show answer & explanation

Answer: A User Pool to manage user registration, sign-in, and provide a user directory.; An Identity Pool to exchange authentication tokens for temporary AWS credentials to access Amazon S3.

Answer

The developer should implement a Cognito User Pool to manage user registration and sign-in, and a Cognito Identity Pool to exchange the authentication tokens for temporary AWS credentials to access Amazon S3.

To support the user registration, authentication, and S3 file uploads, both User Pools and Identity Pools are needed. A Cognito User Pool manages the user directory, sign-up, and sign-in processes (authentication). Once authenticated, a Cognito Identity Pool exchanges the resulting token for temporary AWS credentials (authorization) that the application's frontend can use to upload files directly to Amazon S3.

Step-by-Step Solution

Identify the authentication and directory management component.

Amazon Cognito User Pool.

User Pools serve as the user directory and handle user registration, sign-in, and identity tokens.

Identify the authorization component for accessing AWS resources.

Amazon Cognito Identity Pool.

Identity Pools exchange authentication tokens for temporary AWS credentials (via AWS STS) allowing client-side applications to access services like Amazon S3 directly.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and user directory) and Identity Pools (authorization and temporary AWS credentials for AWS resources).

Question 213Question →

An enterprise manages its application secrets in a dedicated security AWS account (Account A). A containerized microservice deployed on Amazon ECS Fargate in a production AWS account (Account B) needs access to a third-party payment provider's API key. This API key must be automatically rotated every 30 days using a custom rotation lifecycle, and the microservice must retrieve the plaintext key at runtime via the AWS SDK. Which configuration should the developer implement to meet these requirements securely?

Store the API key in AWS Secrets Manager in Account A. Attach a resource-based policy to the secret that grants retrieve permissions to the ECS Task Role in Account B. Configure AWS Secrets Manager to automatically rotate the secret every 30 days using a custom AWS Lambda function in Account A.

Store the API key as a SecureString parameter in Systems Manager Parameter Store in Account A. Attach a resource-based policy to the parameter that grants read permissions to the ECS Task Role in Account B, and configure Systems Manager to perform automatic rotation using a custom AWS Lambda function.

Store the API key in AWS Secrets Manager in Account A. Attach a resource-based policy to the secret that grants retrieve permissions to the ECS Task Execution Role in Account B. Configure AWS Secrets Manager to automatically rotate the secret every 30 days using a custom AWS Lambda function in Account A.

Store the API key in Systems Manager Parameter Store as a SecureString parameter in Account B. Hardcode the AWS Access Key ID and Secret Access Key of an IAM user from Account A in the Fargate container environment variables, and configure a cron job within the container to rotate the parameter.

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager in Account A. Attach a resource-based policy to the secret that grants retrieve permissions to the ECS Task Role in Account B. Configure AWS Secrets Manager to automatically rotate the secret every 30 days using a custom AWS Lambda function in Account A.

Answer

Store the API key in AWS Secrets Manager in Account A, allow access to the ECS Task Role in Account B using a resource-based policy, and configure automatic rotation using an AWS Lambda function in Account A.

The correct solution stores the API key in AWS Secrets Manager in Account A because it natively supports resource-based policies for direct cross-account access and provides automatic rotation using AWS Lambda. The permissions must be granted to the ECS Task Role in Account B since the application retrieves the secret at runtime using the AWS SDK.

Step-by-Step Solution

Determine the service to use for secret storage and rotation.

AWS Secrets Manager is selected because it natively supports automatic rotation via custom Lambda functions and allows resource-based policies for simple cross-account access.

Systems Manager Parameter Store does not support resource-based policies or built-in automatic rotation.

Select the correct IAM role for the Fargate task.

The ECS Task Role is selected.

The application code retrieves the secret at runtime using the AWS SDK, which relies on permissions associated with the Task Role. The Task Execution Role is only used by the container agent during container startup.

Configure the cross-account access policy.

A resource-based IAM policy is attached to the secret in Account A, granting 'secretsmanager:GetSecretValue' permissions to the ECS Task Role ARN in Account B.

This configuration allows the Task Role in Account B to directly fetch the secret from Account A without assuming another role.

Set up the rotation window and target.

A custom Lambda function in Account A is linked to the secret to handle the API key rotation lifecycle every 30 days.

AWS Secrets Manager handles the scheduling and triggers the Lambda function to coordinate the secret update with the third-party provider.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store for secret rotation and cross-account access, while correctly applying ECS Task Roles for runtime application permissions.

Question 214Question →

A developer is deploying a serverless microservice on AWS Lambda that requires access to an Amazon RDS database. The developer needs to store the database host URL (non-sensitive configuration) and the database password (sensitive credential). The database password must be automatically rotated every 30 days. Which combination of actions should the developer take to meet these requirements in the most secure and cost-effective manner? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and enable automatic rotation.

Store the database host URL as a String parameter in AWS Systems Manager Parameter Store.

Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter and configure scheduled automatic rotation.

Hardcode the database password directly within the Lambda function code to minimize configuration overhead.

Store both the database host URL and the database password in AWS Secrets Manager as a single JSON secret with automatic rotation enabled.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation.; Store the database host URL as a String parameter in AWS Systems Manager Parameter Store.

Answer

The developer should store the database password in AWS Secrets Manager with automatic rotation enabled, and store the database host URL in AWS Systems Manager Parameter Store.

The correct options are storing the database password in AWS Secrets Manager and storing the database host URL in AWS Systems Manager Parameter Store. Storing the password in AWS Secrets Manager ensures security and enables native automatic rotation (especially for RDS). Storing the host URL in Systems Manager Parameter Store is the most cost-effective solution for non-sensitive configuration details because standard parameters in Parameter Store are free, avoiding unnecessary Secrets Manager fees.

Step-by-Step Solution

Identify the sensitivity of the data and rotation requirements.

The host URL is non-sensitive, whereas the database password is a sensitive credential requiring automatic rotation.

This allows selecting the most secure and cost-effective service for each type of configuration data.

Determine the appropriate service for the sensitive database password.

AWS Secrets Manager is chosen because it supports automatic rotation natively, particularly for Amazon RDS.

Systems Manager Parameter Store does not natively support automatic rotation.

Determine the appropriate service for the non-sensitive host URL.

AWS Systems Manager Parameter Store (standard String parameter) is chosen because it is free of charge and ideal for plain text configuration parameters.

Storing non-sensitive data in AWS Secrets Manager would incur unnecessary costs.

Key Concept

Selecting the appropriate secrets management service based on sensitivity, rotation requirements, and cost-efficiency.

Estimated Time:1m 0s

Question 215Question →

A developer is building an application that must encrypt raw sensor data files, each approximately $20\text{ MB}$ in size, locally on an application server before uploading them to a third-party storage system. The developer wants to use envelope encryption with a customer managed AWS KMS key. Which two steps must the developer perform to implement this encryption process?

Select all that apply

Call the GenerateDataKey API operation using the customer managed KMS key to obtain a plaintext data key and an encrypted copy of the data key.

Encrypt the sensor data locally using the plaintext data key, and then delete the plaintext data key from memory.

Call the KMS Encrypt API operation directly to encrypt each sensor data file.

Call the GenerateDataKeyWithoutPlaintext API operation, and decrypt the returned ciphertext using the public certificate of the KMS key.

Store the plaintext data key as a SecureString parameter in AWS Systems Manager Parameter Store to use for subsequent decryption operations.

Show answer & explanation

Answer: Call the GenerateDataKey API operation using the customer managed KMS key to obtain a plaintext data key and an encrypted copy of the data key.; Encrypt the sensor data locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To implement envelope encryption for files larger than

4\text{ KB}

, the developer must call the GenerateDataKey API to obtain both a plaintext and an encrypted data key, encrypt the data locally using the plaintext data key, and then immediately destroy the plaintext key from memory.

The correct steps for envelope encryption involve calling the GenerateDataKey API operation to retrieve a plaintext data key and an encrypted version of that key. The application then uses the plaintext data key to perform local symmetric encryption of the payload, and finally deletes the plaintext key from memory. The encrypted data key is saved alongside the encrypted data so that it can be decrypted by KMS later.

Step-by-Step Solution

Invoke the KMS GenerateDataKey API.

The API returns a plaintext version of the data key and a ciphertext version encrypted under the customer managed KMS key.

Because the files are

20\text{ MB}

in size, they exceed the direct KMS encryption limit of

4\text{ KB}

, requiring local envelope encryption.

Encrypt the raw sensor data locally using a symmetric encryption algorithm and the plaintext data key.

The file is encrypted to a ciphertext payload.

Performing encryption locally offloads the cryptographic workload from KMS to the application server.

Discard the plaintext data key from application memory, and store the encrypted data key alongside the encrypted payload.

Only the encrypted data key and the encrypted payload remain.

Retaining the plaintext key in memory increases security risks. The encrypted data key is safe to store next to the encrypted file and will be used during decryption.

Key Concept

Envelope encryption is the practice of encrypting plaintext data with a data key, and then encrypting the data key under another key (the KMS root key). It is required for encrypting data payloads larger than

4\text{ KB}

using AWS KMS.

Question 216Question →

A developer is deploying a web application where the frontend authenticates users via a third-party Identity Provider (IdP) using OpenID Connect (OIDC). The frontend needs to make requests to a backend service exposed through an Amazon API Gateway HTTP API. The API must validate the incoming JSON Web Token (JWT) at the gateway layer before routing the request to backend AWS Lambda functions. The developer wants to implement this validation with the least amount of custom code and lowest latency. Which of the following configuration steps should the developer perform?

Configure a built-in JWT authorizer on the HTTP API, providing the Issuer URL from the third-party IdP and the target Audience, and associate it with the API routes.

Create an Amazon Cognito Identity Pool to exchange the third-party JWT for temporary AWS IAM credentials, and configure IAM authorization on the HTTP API routes.

Create an Amazon API Gateway Lambda authorizer that parses the JWT, calls the third-party IdP's validation endpoint, and generates an IAM policy to allow the request.

Configure a Lambda proxy integration that passes the raw authorization header to the backend Lambda function, and validate the JWT within the application code of each backend function.

Show answer & explanation

Answer: Configure a built-in JWT authorizer on the HTTP API, providing the Issuer URL from the third-party IdP and the target Audience, and associate it with the API routes.

Answer

Configure a built-in JWT authorizer on the HTTP API, providing the Issuer URL from the third-party IdP and the target Audience, and associate it with the API routes.

The correct answer is to configure a built-in JWT authorizer on the HTTP API. Amazon API Gateway HTTP APIs provide native support for JWT validation against OIDC-compliant Identity Providers. This built-in mechanism validates token signatures, expiration dates, and scopes without executing custom Lambda code, offering the lowest latency and overhead.

Step-by-Step Solution

Select the API Gateway HTTP API and create a new Authorizer under the Security section.

A template for creating a new authorizer is displayed.

An authorizer is required at the gateway layer to intercept incoming requests and validate credentials before they reach the backend.

Choose JWT as the authorizer type, and configure the Identity Source (typically the Authorization header), Issuer URL (the third-party IdP's URL), and Audience (the client ID).

API Gateway automatically fetches the public keys (JWKS) from the OIDC issuer to validate incoming tokens.

This utilizes API Gateway's built-in OAuth 2.0 / OIDC capabilities to check token signatures and claims without custom code.

Attach the newly created JWT authorizer to the target HTTP API routes.

The HTTP API routes are now protected, and unauthorized requests are blocked directly at the gateway with a 401 Unauthorized status.

Associating the authorizer with specific routes ensures that only authenticated requests with valid tokens are forwarded to the backend integrations.

Key Concept

API Gateway HTTP APIs support built-in JWT authorizers that natively validate tokens from OpenID Connect (OIDC) compatible identity providers, eliminating the need for custom authorizer Lambda functions or IAM credential exchange.

Question 217Question →

A developer is implementing a secure file upload utility in a Python application using the AWS SDK (Boto3). The utility must encrypt sensitive medical imaging files, each approximately $150\text{ MB}$ in size, client-side before uploading them to an Amazon S3 bucket. The application must use envelope encryption with a customer managed key (CMK) in AWS KMS to manage the encryption keys. Which programmatic workflow should the developer implement to encrypt each file while minimizing AWS KMS API calls and network overhead?

Call the generate_data_key API method passing the CMK identifier and specifying the AES_256 key spec. Use the returned plaintext data key to encrypt the file locally. Upload the encrypted file and the returned ciphertext data key to Amazon S3, then purge the plaintext data key from memory.

Call the generate_data_key_without_plaintext API method passing the CMK identifier. Call the decrypt API method passing the returned ciphertext data key to retrieve the plaintext data key. Use the plaintext data key to encrypt the file locally, then upload the encrypted file and the ciphertext data key to Amazon S3.

Call the encrypt API method passing the CMK identifier and the file contents in

4\text{ KB}

chunks. Concatenate the returned ciphertexts and upload the final consolidated file to Amazon S3.

Call the generate_data_key API method to retrieve a plaintext data key and a ciphertext data key. Call the encrypt API method passing the plaintext data key to encrypt it again with the CMK. Use the newly encrypted data key to encrypt the file, and upload the file to Amazon S3.

Show answer & explanation

Answer: Call the generate_data_key API method passing the CMK identifier and specifying the AES_256 key spec. Use the returned plaintext data key to encrypt the file locally. Upload the encrypted file and the returned ciphertext data key to Amazon S3, then purge the plaintext data key from memory.

Answer

The correct workflow is to call the generate_data_key API method, which returns both the plaintext data key (to immediately encrypt the file locally) and the ciphertext data key (to be uploaded to S3 along with the encrypted file). This ensures the envelope encryption is completed in a single KMS API call and local resources do not retain the plaintext key in memory after encryption.

Step-by-Step Solution

Generate the data key using the KMS customer managed key (CMK).

A plaintext data key and a ciphertext (encrypted) data key are returned by AWS KMS in a single API call.

Calling generate_data_key generates both key representations, avoiding the need for separate generation and encryption API calls.

Perform client-side encryption on the medical imaging file.

The file is encrypted locally using the plaintext data key and a symmetric encryption algorithm (like AES-256).

Local encryption keeps the large file payload (

150\text{ MB}

) out of KMS network transits, complying with KMS payload limits.

Store the encrypted file and the ciphertext data key in Amazon S3, and clean up memory.

The encrypted payload and ciphertext data key are uploaded to S3, and the plaintext data key is removed from application memory.

Storing the ciphertext data key alongside the encrypted file ensures it can be decrypted later, while purging the plaintext key secures it against memory-based attacks.

Key Concept

AWS KMS client-side envelope encryption workflow utilizing generate_data_key.

Question 218Question →

A developer is configuring an AWS Lambda function that needs to retrieve objects from an Amazon S3 bucket. Which of the following configurations represents the most secure method to grant the Lambda function the necessary permissions to access the S3 bucket?

Create an IAM role with a permissions policy allowing s3:GetObject, and configure the trust policy of the role to allow the s3.amazonaws.com service principal to assume it.

Create an IAM execution role with a permissions policy that allows s3:GetObject on the specific bucket, configure the trust policy of the role to allow the lambda.amazonaws.com service principal to assume it, and associate this role with the Lambda function.

Initialize the AWS SDK client inside the Lambda function code using hardcoded AWS access keys of an IAM user that has read access to the S3 bucket.

Assign an ECS Task Execution Role containing the necessary S3 permissions to the Lambda function configuration.

Show answer & explanation

Answer: Create an IAM execution role with a permissions policy that allows s3:GetObject on the specific bucket, configure the trust policy of the role to allow the lambda.amazonaws.com service principal to assume it, and associate this role with the Lambda function.

Answer

The correct answer correctly specifies creating an IAM execution role, defining its permissions policy to allow s3:GetObject, configuring its trust policy to allow lambda.amazonaws.com to assume it, and associating the role with the Lambda function. This follows the principle of least privilege and uses secure, temporary credentials.

Step-by-Step Solution

Determine the resource access model.

AWS Lambda functions assume execution roles to get temporary credentials for other AWS services.

This avoids hardcoding long-lived access keys in code or environment variables.

Define the IAM execution role components.

The role must have a trust policy for the Lambda service principal (lambda.amazonaws.com) and a permissions policy for s3:GetObject on the bucket.

The trust policy allows Lambda to assume the role, while the permissions policy allows the assumed role to access S3.

Associate the role.

Attach the configured IAM execution role to the Lambda function configuration.

This grants the Lambda function instance the identity and temporary credentials of the role during execution.

Key Concept

IAM Execution Roles for AWS Lambda

Question 219Question →

An e-commerce application requires users to authenticate before they can download digital invoice PDFs directly from a private Amazon S3 bucket. The developer has set up user registration and authentication using Amazon Cognito. Which Cognito component must be configured to exchange the authenticated user session for temporary, limited-privilege AWS credentials?

Cognito Identity Pools

Cognito User Pools

API Gateway Lambda Authorizer

Cognito User Pool Authorizer

Show answer & explanation

Answer: Cognito Identity Pools

Answer

Cognito Identity Pools

Cognito Identity Pools (Federated Identities) enable applications to obtain temporary, limited-privilege AWS credentials. These credentials allow client applications to make direct calls to AWS services such as Amazon S3, using IAM roles associated with the authenticated or unauthenticated identity pool users.

Step-by-Step Solution

Identify the primary requirement: the client application needs temporary, limited-privilege AWS credentials to interact directly with an AWS service (Amazon S3).

Temporary AWS credentials (access key, secret key, and session token) are required.

Direct calls to S3 APIs from a client application require AWS credentials rather than standard OAuth/OIDC identity or access tokens.

Evaluate the difference between Cognito User Pools and Cognito Identity Pools.

User Pools manage the user directory and authentication, while Identity Pools provide AWS credentials (authorization) based on successful authentication.

To bridge the gap between user identity (authentication) and AWS permissions (authorization), Cognito Identity Pools must be configured.

Key Concept

Amazon Cognito Identity Pools are used to federate identities and obtain temporary AWS credentials for accessing AWS resources directly.

Estimated Time:45s

Question 220Question →

A developer is building a serverless web application. The application requires users to register and sign in. Additionally, authenticated users must be allowed to upload files directly to a private Amazon S3 bucket. Which TWO Amazon Cognito components are required to meet these requirements?

Select all that apply

An Amazon Cognito User Pool to manage user registration, authentication, and the user directory

An Amazon Cognito Identity Pool to authorize users and provide temporary AWS credentials for accessing the Amazon S3 bucket

A custom Amazon API Gateway Lambda Authorizer to generate temporary IAM credentials for direct Amazon S3 bucket access

An Amazon Cognito User Pool configured to directly issue temporary AWS credentials to the client web application

An Amazon API Gateway Cognito Authorizer configured to authorize direct uploads to the Amazon S3 bucket

Show answer & explanation

Answer: An Amazon Cognito User Pool to manage user registration, authentication, and the user directory; An Amazon Cognito Identity Pool to authorize users and provide temporary AWS credentials for accessing the Amazon S3 bucket

Answer

The developer must use an Amazon Cognito User Pool to manage user registration, authentication, and the user directory, alongside an Amazon Cognito Identity Pool to authorize users and provide temporary AWS credentials for accessing the Amazon S3 bucket.

To implement user authentication (sign-up, sign-in, directory), a Cognito User Pool is required. To authorize the users to access AWS resources directly, such as uploading files to Amazon S3, an Amazon Cognito Identity Pool is required to exchange the User Pool tokens for temporary AWS IAM credentials.

Step-by-Step Solution

Implement a user directory and sign-up/sign-in flows using Amazon Cognito User Pools.

Users are authenticated and receive JSON Web Tokens (JWTs) representing their identity.

To verify user identities and manage their authentication status.

Configure an Amazon Cognito Identity Pool and link it to the Cognito User Pool.

The client application can exchange the User Pool JWTs for temporary AWS credentials.

To authorize authenticated users to access AWS services directly.

Assign an IAM Role to the authenticated user group in the Identity Pool with permissions to write to the Amazon S3 bucket.

The temporary AWS credentials grant the necessary permissions to write files directly to Amazon S3.

To enforce fine-grained access control on the target AWS resource.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and identity directory) and Identity Pools (authorization and temporary AWS credentials).

PreviousPage 11 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept