Security

390 questions

All types390 Multiple choice195 Multiple select195

A developer is implementing a secure report retrieval feature for a corporate intranet portal. The portal's users authenticate using an Amazon Cognito User Pool. Once authenticated, the portal's client-side application needs to download private reports directly from an Amazon S3 bucket. To optimize performance and cost, the architecture must not route the file downloads through an intermediate API Gateway or Lambda function. The solution must grant users direct, short-lived access to the reports using the least privilege principle.

Which TWO configuration steps should the developer perform to meet these requirements?

Select all that apply

Configure an Amazon Cognito Identity Pool and add the Cognito User Pool as an identity provider.

Attach an IAM policy granting s3:GetObject permissions to the IAM role associated with authenticated users in the Identity Pool.

Generate temporary AWS credentials by calling the AWS STS AssumeRole API directly from the client application using the Cognito User Pool ID token.

Configure an Amazon API Gateway endpoint with a Cognito User Pool authorizer to route S3 file downloads.

Create an IAM User for each Cognito User Pool user and store their access keys in the application client.

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool and add the Cognito User Pool as an identity provider.; Attach an IAM policy granting s3:GetObject permissions to the IAM role associated with authenticated users in the Identity Pool.

Answer

Configure an Amazon Cognito Identity Pool and add the Cognito User Pool as an identity provider, and attach an IAM policy granting s3:GetObject permissions to the IAM role associated with authenticated users in the Identity Pool.

To authorize authenticated Cognito User Pool users to directly access private S3 resources, the developer must configure an Amazon Cognito Identity Pool that lists the User Pool as its identity provider. The developer must then attach an IAM policy granting s3:GetObject permissions to the authenticated IAM role of the Identity Pool. This allows the client-side application to obtain short-lived AWS credentials containing the necessary permissions to retrieve files directly from S3 without passing through intermediate compute layers.

Step-by-Step Solution

Configure the identity directory

Ensure users authenticate via the Amazon Cognito User Pool, which validates credentials and issues JSON Web Tokens (JWTs).

Provides the initial authentication mechanism and user directory.

Set up federated authorization

Create an Amazon Cognito Identity Pool and register the Cognito User Pool ID/App Client ID as the identity provider.

Establishes a mechanism to exchange identity tokens (JWTs) for temporary AWS credentials.

Configure IAM permissions

Attach an IAM policy with s3:GetObject permission for the target S3 bucket to the Identity Pool's authenticated IAM role.

Ensures that the client application receives credentials authorized to retrieve reports directly from S3.

Key Concept

Amazon Cognito Authentication and Authorization using User Pools and Identity Pools

Estimated Time:2m 0s

Question 342Question →

A developer is building a backend application on AWS Lambda that integrates with a third-party payment gateway. The integration requires an API key that is rotated automatically every 30 days. The developer needs to store the API key securely, automate its rotation, and retrieve it in the Lambda function with minimal latency. Which storage and management approach should the developer use to meet these requirements with the least operational effort?

Store the API key in AWS Secrets Manager. Configure automated rotation in AWS Secrets Manager by writing a custom AWS Lambda rotation function, and retrieve the key in the backend Lambda function using the AWS SDK with local caching.

Store the API key in Systems Manager Parameter Store as a SecureString parameter. Enable the built-in Parameter Store lifecycle policy to automatically rotate the parameter every 30 days.

Store the API key in Systems Manager Parameter Store as a SecureString parameter. Configure an Amazon EventBridge scheduler to trigger a custom AWS Lambda function every 30 days to generate and update the Parameter Store parameter.

Hardcode the API key directly within the backend Lambda function's handler code and use AWS CodePipeline to automatically rebuild and redeploy the function when the key is updated by the payment gateway.

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure automated rotation in AWS Secrets Manager by writing a custom AWS Lambda rotation function, and retrieve the key in the backend Lambda function using the AWS SDK with local caching.

Answer

Store the API key in AWS Secrets Manager, configure automated rotation using a custom Lambda function, and retrieve the key in the backend Lambda function using the AWS SDK with local caching.

Storing the API key in AWS Secrets Manager and configuring a custom Lambda rotation function allows AWS to natively manage the rotation schedule and execution. The application Lambda function retrieves the key at runtime using the AWS SDK, and caching it locally ensures subsequent invocations do not call Secrets Manager unnecessarily, minimizing latency and API costs.

Step-by-Step Solution

Create a secret in AWS Secrets Manager to store the third-party payment gateway API key.

The API key is securely encrypted and stored.

AWS Secrets Manager is optimized for securing credentials and sensitive values.

Configure AWS Secrets Manager rotation settings by linking a custom AWS Lambda rotation function and setting the schedule to 30 days.

Secrets Manager automatically invokes the Lambda function on schedule to update the secret value.

This automates the rotation lifecycle with native orchestrations instead of custom cron schedulers.

Update the application Lambda function to retrieve the API key using the AWS SDK and cache the value in memory.

The key is fetched at startup or initialization and reused across invocations, lowering latency and reducing cost.

Local caching minimizes the number of API calls to AWS Secrets Manager.

Key Concept

Automating secret rotation using AWS Secrets Manager vs manual orchestration or insecure alternatives.

Question 343Question →

A developer is designing a web application that uses Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for the backend. The API endpoints must be secured so that only users with an 'Active' subscription can access them. The subscription status is stored in an external Amazon DynamoDB table and updated in real-time, which prevents it from being stored as a static attribute in the Cognito ID or access tokens. Which solution should the developer implement to secure the API Gateway endpoints?

Implement a Cognito User Pool Authorizer on API Gateway, and configure a Cognito Post-Authentication Lambda trigger to query the DynamoDB table and dynamically inject the subscription status into the API Gateway authorizer context.

Implement a Cognito Identity Pool to exchange the User Pool token for temporary AWS credentials, and attach an IAM policy to the authenticated role that uses policy conditions to query the DynamoDB table in real-time.

Implement an API Gateway Lambda Authorizer that validates the incoming Cognito token, queries the DynamoDB table to verify the user's subscription status, and returns an IAM policy to allow or deny the request.

Implement a Cognito User Pool Authorizer on API Gateway, and configure API Gateway integration request mapping templates to query the DynamoDB table and reject unauthorized requests before they reach the backend.

Show answer & explanation

Answer: Implement an API Gateway Lambda Authorizer that validates the incoming Cognito token, queries the DynamoDB table to verify the user's subscription status, and returns an IAM policy to allow or deny the request.

Answer

An API Gateway Lambda Authorizer allows custom authorization logic. In this scenario, it can parse and validate the Cognito token to authenticate the user, query DynamoDB to check the real-time subscription status, and dynamically generate an IAM policy that allows or denies access to the API resources.

Step-by-Step Solution

Analyze the authentication and authorization requirements.

Authentication is handled by Cognito User Pools (JWT tokens are provided to the client). Authorization requires a real-time check against an external DynamoDB table.

Determines whether the built-in Cognito Authorizer is sufficient or if a custom authorization mechanism is required.

Evaluate the capabilities of the native Cognito User Pool Authorizer.

The native authorizer can only validate token signatures, expiration, and audience. It cannot perform external lookups or query DynamoDB.

Eliminates solutions relying solely on the built-in Cognito User Pool Authorizer for dynamic database checks.

Select and configure an API Gateway Lambda Authorizer.

The Lambda Authorizer receives the token, decodes and validates it, queries DynamoDB for the real-time subscription status, and returns an IAM policy.

Provides the custom validation logic needed to satisfy the real-time subscription requirement before the request reaches the backend.

Key Concept

Using API Gateway Lambda Authorizers for custom, dynamic authorization checks that cannot be performed by built-in Cognito Authorizers.

Estimated Time:1m 30s

Question 344Question →

A company runs a logistics tracking service on AWS Fargate. The application needs to retrieve a sensitive API key for a third-party shipping service dynamically at runtime. The API key is managed by a separate security team in a dedicated AWS account, where it must be rotated every 90 days. The Fargate tasks in the application account must access this key securely. To implement this configuration, which two steps should be performed? (Select TWO.)

Select all that apply

Create a secret in AWS Secrets Manager within the security account, and apply a resource-based policy to allow retrieval from the application account's Fargate task roles.

Configure an AWS Lambda function in the security account to handle the API key rotation, and associate it with the Secrets Manager secret on a 90-day schedule.

Create a Parameter Store parameter of type SecureString in the security account, and apply a resource-based policy to grant access to the application account's Fargate tasks.

Create a secret in AWS Secrets Manager within the security account, and attach the read permissions to the Fargate task execution roles in the application account.

Define the API key as a plaintext parameter in Systems Manager Parameter Store, and hardcode the security account's IAM access keys in the application's SDK client constructor.

Show answer & explanation

Answer: Create a secret in AWS Secrets Manager within the security account, and apply a resource-based policy to allow retrieval from the application account's Fargate task roles.; Configure an AWS Lambda function in the security account to handle the API key rotation, and associate it with the Secrets Manager secret on a 90-day schedule.

Answer

To securely share and rotate the key across accounts, the developer must use AWS Secrets Manager in the security account with a resource-based policy permitting access to the application's Fargate task roles, and configure a custom AWS Lambda function to perform the 90-day rotation.

To support both cross-account access and automated rotation, AWS Secrets Manager is the correct service choice. A resource-based policy attached directly to the secret allows the application's Fargate task roles in a separate account to read the secret directly. Additionally, Secrets Manager integrates with AWS Lambda to orchestrate the rotation logic on a schedule.

Step-by-Step Solution

Select the proper service for cross-account access and rotation.

AWS Secrets Manager is chosen instead of Systems Manager Parameter Store.

Secrets Manager natively supports resource-based policies for cross-account access and has built-in rotation functionality, whereas Parameter Store parameters do not support resource-based policies.

Configure permissions for the Fargate tasks.

Attach a resource-based policy to the Secrets Manager secret allowing the Fargate task roles to retrieve it.

Dynamic runtime API calls by application code require permissions attached to the task role itself, not the task execution role.

Implement the automatic rotation.

Create a Lambda function to perform rotation and set the rotation schedule on the secret to 90 days.

AWS Secrets Manager uses a Lambda function to execute rotation workflows automatically.

Key Concept

Cross-account access and automatic rotation of sensitive credentials using AWS Secrets Manager, and distinguishing between Fargate task roles and task execution roles.

Question 345Question →

An IoT startup is developing a dashboard web application that allows users to authenticate using external social providers (Google and Apple) via Amazon Cognito. Once authenticated, the web application must interact with two backend systems:
1. Make authenticated requests to an Amazon API Gateway HTTP API that manages dashboard configurations.
2. Directly publish sensor telemetry data to an Amazon Kinesis Data Stream.

Which TWO configurations must the developer implement to secure access to these resources? (Select TWO.)

Select all that apply

Configure an Amazon Cognito User Pool federated with Google and Apple, and set up an Amazon API Gateway JWT authorizer that validates the identity tokens issued by the User Pool.

Configure an Amazon Cognito Identity Pool that integrates with the User Pool as an identity provider, and associate an IAM role with the authenticated identities that grants kinesis:PutRecord permissions.

Configure an Amazon Cognito User Pool federated with Google and Apple, and set up the User Pool to directly issue temporary AWS security credentials to the client application for publishing to the Kinesis Data Stream.

Create a custom Lambda Authorizer in Amazon API Gateway that intercepts requests, extracts the User Pool access token, and calls the Cognito GetUser API to validate the token signature.

Use Amazon Cognito Identity Pools to authorize requests to the API Gateway HTTP API by passing the Identity Pool ID in the Authorization header of the HTTP requests.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool federated with Google and Apple, and set up an Amazon API Gateway JWT authorizer that validates the identity tokens issued by the User Pool.; Configure an Amazon Cognito Identity Pool that integrates with the User Pool as an identity provider, and associate an IAM role with the authenticated identities that grants kinesis:PutRecord permissions.

Answer

To secure the HTTP API, configure a User Pool federated with Google and Apple and use an API Gateway JWT authorizer. To authorize direct Kinesis writes, configure an Identity Pool that exchanges User Pool tokens for temporary AWS credentials with the required IAM policy.

Setting up a Cognito User Pool with Google and Apple federation allows the application to authenticate users and receive JSON Web Tokens (JWTs). These JWTs can be natively validated by an API Gateway HTTP API JWT authorizer. An Identity Pool takes the token from the authenticated User Pool session and exchanges it for temporary AWS credentials via an IAM role, which allows the application to directly call the Kinesis API.

Step-by-Step Solution

Determine how to authenticate users via Google and Apple and secure API Gateway HTTP API routes.

Identify that an Amazon Cognito User Pool acts as the user directory and identity provider (IdP), and that API Gateway HTTP APIs can use a native JWT authorizer to validate the issued token.

User Pools handle authentication and federation with social providers, while API Gateway JWT authorizers offer low-latency, built-in validation of these user pool tokens.

Determine how the client application can write to the Amazon Kinesis Data Stream directly.

Identify that the client needs temporary AWS credentials authorized via an IAM role to call the Kinesis API.

Cognito Identity Pools exchange Cognito User Pool tokens for temporary AWS security credentials, enabling direct, secure client access to AWS resources like Kinesis.

Associate the IAM role with the correct Cognito construct.

Configure the Cognito Identity Pool with the authenticated IAM role containing the kinesis:PutRecord policy.

This maps authenticated users to the specific AWS IAM policy required to publish telemetry data to Kinesis.

Key Concept

Distinguishing and integrating Amazon Cognito User Pools for user authentication and Identity Pools for AWS resource authorization.

Estimated Time:2m 0s

Question 346Question →

A developer is building a corporate portal where employees must sign in using their existing SAML 2.0 Identity Provider (IdP) credentials. The portal's backend API, hosted on Amazon API Gateway, requires custom user claims such as department and employee ID to perform fine-grained authorization. Which configuration will meet these requirements with the least development effort?

Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to the corresponding user pool attributes, and configure API Gateway to use a Cognito User Pool authorizer.

Configure the SAML 2.0 IdP in a Cognito Identity Pool, map the SAML assertions to IAM principal tags, and configure API Gateway to use IAM authorization for the backend API.

Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to custom user pool attributes, and write a custom API Gateway Lambda authorizer to parse and validate the SAML token directly.

Configure the SAML 2.0 IdP in a Cognito Identity Pool, map the SAML assertions to Cognito User Pool attributes using a Custom Message Lambda trigger, and configure API Gateway to use a Cognito User Pool authorizer.

Show answer & explanation

Answer: Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to the corresponding user pool attributes, and configure API Gateway to use a Cognito User Pool authorizer.

Answer

Configuring the SAML 2.0 IdP within a Cognito User Pool and mapping its assertions to user pool attributes allows the identity directory to generate JWT ID/access tokens containing the custom claims. Using the native Cognito User Pool authorizer in API Gateway validates these tokens automatically, presenting the claims to the backend integration with minimal configuration and no custom code.

Step-by-Step Solution

Set up a Cognito User Pool and add the SAML 2.0 IdP as a federated provider using the IdP's metadata document.

Cognito User Pool is established as the directory that federates authentication to the external corporate SAML IdP.

This establishes the identity provider trust relationship and configures the user authentication source.

Configure SAML attribute mapping in Cognito User Pool settings to map incoming SAML assertions (e.g., department, employee ID) to standard or custom user pool attributes.

The federated user's identity tokens generated by Cognito (ID token and Access token) will automatically contain these mapped claims.

This ensures the backend API can access the required custom claims in the authorization payload.

Configure an API Gateway Cognito User Pool Authorizer on the API methods, referencing the user pool.

API Gateway automatically validates the incoming ID token sent in the Authorization header and passes the claims to the backend integration context.

This performs token validation and supplies the custom claims to the API with zero custom code or Lambda execution overhead.

Key Concept

Amazon Cognito User Pools support SAML 2.0 federation and direct attribute mapping, allowing standard API Gateway Cognito Authorizers to automatically validate tokens and pass mapped claims to backend integrations without custom Lambda code.

Question 347Question →

A developer is deploying a microservice to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The microservice needs to read messages from an Amazon SQS queue and write records to an Amazon DynamoDB table. During startup, the ECS container agent must pull the container image from Amazon Elastic Container Registry (Amazon ECR) and send container logs to Amazon CloudWatch Logs. Which configuration of IAM roles should the developer specify in the task definition to satisfy these requirements with the least privilege?

Assign an IAM role with permissions for SQS and DynamoDB as the Task Role, and assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Execution Role.

Assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Role, and assign an IAM role with permissions for SQS and DynamoDB as the Task Execution Role.

Assign an IAM role with permissions for SQS, DynamoDB, ECR, and CloudWatch Logs as the Task Role, and do not assign a Task Execution Role.

Assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Execution Role, and hardcode the AWS access keys for SQS and DynamoDB in the application configuration inside the container.

Show answer & explanation

Answer: Assign an IAM role with permissions for SQS and DynamoDB as the Task Role, and assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Execution Role.

Answer

Assign an IAM role with permissions for SQS and DynamoDB as the Task Role, and assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Execution Role.

The correct configuration assigns the application permissions (SQS and DynamoDB) to the Task Role, and infrastructure/agent permissions (ECR image pull and CloudWatch logging) to the Task Execution Role. The ECS agent needs the Task Execution Role to pull the container image and set up logs before starting the container, while the application code inside the container uses the Task Role to interact with AWS services.

Step-by-Step Solution

Identify the credentials required by the application code running inside the container.

The application code requires SQS and DynamoDB access.

The containerized application needs these permissions to execute its business logic after startup.

Identify the permissions required by the Amazon ECS container agent to provision and start the task.

The ECS agent requires ECR image pull and CloudWatch logging permissions.

These permissions are needed by the container agent before the container is running.

Map these requirements to the appropriate ECS task definition parameters.

The Task Role is assigned to the application, and the Task Execution Role is assigned to the ECS agent.

This separation follows the AWS security model and least-privilege principles.

Key Concept

ECS Task Role vs. ECS Task Execution Role distinction in IAM configurations

Estimated Time:1m 30s

Question 348Question →

A developer is deploying a web application to Amazon EC2 instances. The application requires access to a sensitive API key for a third-party marketing platform. The company's security policy mandates that the API key must be encrypted at rest and rotated every 90 days. The developer wants to implement a solution that supports automatic rotation with minimal custom code. Which service and configuration should the developer choose to store and manage the API key?

Store the API key in AWS Systems Manager Parameter Store as a SecureString parameter. Enable the built-in Parameter Store automatic rotation feature and set the rotation interval to 90 days.

Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.

Store the API key in AWS Systems Manager Parameter Store as a String parameter. Use a customer managed key in AWS KMS to encrypt the parameter, and write a cron job on the EC2 instances to update the parameter every 90 days.

Store the API key as an environment variable in the EC2 instance launch template. Use an AWS SDK client within the application code to retrieve the value from the instance metadata service.

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.

Answer

Store the API key in AWS Secrets Manager. Configure an AWS Lambda function to perform the rotation logic, and associate it with the secret to rotate every 90 days.

Storing the API key in AWS Secrets Manager and using a custom AWS Lambda function for rotation is the correct approach. Secrets Manager natively supports automatic rotation of secrets using Lambda functions. Since this is a third-party API key, a custom Lambda function is required to perform the rotation steps, meeting the 90-day rotation requirement with minimal custom code.

Step-by-Step Solution

Evaluate the security and rotation requirements for the sensitive API key.

Identify that the API key must be encrypted at rest and automatically rotated every 90 days.

Establishing these requirements guides the selection of the correct AWS service that supports automatic secret rotation.

Compare AWS Secrets Manager and Systems Manager Parameter Store capabilities.

AWS Secrets Manager is selected because it provides built-in rotation functionality via integration with AWS Lambda, whereas Parameter Store does not support native automatic rotation.

Secrets Manager is designed specifically for managing secrets that require automatic rotation, while Parameter Store is suited for configuration management.

Configure the rotation mechanism for the non-AWS resource (third-party API).

A custom AWS Lambda function is configured to handle the specific rotation logic for the third-party marketing platform, and the rotation schedule is set to 90 days on the Secrets Manager secret.

For non-RDS and third-party services, Secrets Manager uses a Lambda function to perform the steps required to rotate the credentials.

Key Concept

AWS Secrets Manager vs. AWS Systems Manager Parameter Store for secrets rotation

Estimated Time:1m 30s

Question 349Question →

A developer is configuring a microservices application running on Amazon Elastic Kubernetes Service (Amazon EKS). The application needs to retrieve database credentials to connect to an Amazon RDS for Microsoft SQL Server database. The company's security policy requires that these credentials be encrypted at rest and automatically rotated every 30 days without manual intervention or application redeployment. Which TWO steps should the developer perform to meet these requirements securely? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager.

Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter.

Configure an Amazon EventBridge scheduled rule to trigger a custom script that rotates the database password and updates the parameter in Systems Manager Parameter Store.

Hardcode the database credentials within the application's codebase and decrypt them at runtime using the AWS SDK and a customer managed key in AWS KMS.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager.; Configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Answer

Store the database credentials in AWS Secrets Manager and configure AWS Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda rotation function.

Storing the database credentials in AWS Secrets Manager is correct because Secrets Manager is designed for storing sensitive data like database credentials and supports automatic rotation natively. Configuring Secrets Manager to use an AWS Lambda rotation function to update the database credentials every 30 days fulfills the rotation requirement with minimal operational overhead, since AWS provides pre-built Lambda templates for RDS database credential rotation.

Step-by-Step Solution

Select the appropriate credential storage service.

Choose AWS Secrets Manager over Systems Manager Parameter Store because only Secrets Manager natively supports managed automatic rotation.

Parameter Store does not have native automatic rotation features, which makes Secrets Manager the correct choice for credential rotation requirements.

Configure the secret rotation mechanism.

Associate the secret with a Lambda rotation function that updates both the database and the Secrets Manager secret value.

AWS Secrets Manager uses a Lambda function to perform the steps required to securely rotate database credentials on a schedule.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for credentials requiring rotation

Estimated Time:1m 30s

Question 350Question →

A developer is implementing an AWS Lambda function in Account A (111122223333) that needs to retrieve sensitive configuration data from an Amazon S3 bucket located in Account B (444455556666). The developer wants to use the AWS Security Token Service (STS) to assume an IAM role named CrossAccountS3Reader in Account B to access the bucket. The Lambda function runs under an execution role named LambdaExecutionRole in Account A.

Which of the following actions must the developer perform to establish this cross-account access? (Select TWO.)

Select all that apply

Modify the trust policy of the CrossAccountS3Reader role in Account B to allow the LambdaExecutionRole ARN from Account A to perform the sts:AssumeRole action.

Attach a permissions policy to the LambdaExecutionRole in Account A that grants sts:AssumeRole permission on the CrossAccountS3Reader role ARN in Account B.

Hardcode the AWS access key ID and secret access key of an IAM user created in Account B directly into the Lambda function's initialization code.

Update the trust policy of the CrossAccountS3Reader role in Account B to specify the service principal lambda.amazonaws.com as the trusted entity.

Attach a resource policy to the Lambda function in Account A that allows the CrossAccountS3Reader role in Account B to push credentials to the function.

Show answer & explanation

Answer: Modify the trust policy of the CrossAccountS3Reader role in Account B to allow the LambdaExecutionRole ARN from Account A to perform the sts:AssumeRole action.; Attach a permissions policy to the LambdaExecutionRole in Account A that grants sts:AssumeRole permission on the CrossAccountS3Reader role ARN in Account B.

Answer

Modifying the trust policy of the target role in Account B to trust the execution role in Account A, and attaching an STS assume role policy to the execution role in Account A.

The correct options state that you must modify the trust policy of the destination role in the target account to trust the source execution role, and attach a policy to the source execution role in the origin account allowing it to assume the destination role. Both parts are mandatory to establish cross-account trust.

Step-by-Step Solution

Configure the target role trust relationship

The trust policy of the CrossAccountS3Reader role in Account B is updated to list the ARN of LambdaExecutionRole from Account A as a principal and allow the sts:AssumeRole action.

This establishes trust from the destination account's perspective, permitting the identity from the source account to assume the role.

Grant assume role permissions to the source identity

An identity-based permissions policy is attached to LambdaExecutionRole in Account A, allowing the sts:AssumeRole action on the ARN of the CrossAccountS3Reader role.

This grants the source identity the necessary API permission to invoke the AWS STS assume role command.

Key Concept

Establishing cross-account IAM role assumption requires configuring both the trust policy on the target role to trust the source identity, and the identity permissions policy on the source identity to allow the AssumeRole call.

Question 351Question →

A developer is building a mobile gaming application that requires authenticated users to save their game progress files directly to an Amazon S3 bucket. The game progress files must be stored in a folder path specific to each user. Additionally, the application needs to call a secure REST API hosted on Amazon API Gateway to post high scores. The developer wants to use Amazon Cognito for authentication and authorization with the least operational overhead.

Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and map authenticated users to an IAM role that grants access to the S3 bucket using the cognito-identity.amazonaws.com:sub variable in the resource path policy.

Configure an API Gateway Cognito Authorizer on the REST API methods, and configure the mobile app to include the Cognito User Pool identity token in the Authorization header of the requests.

Enable S3 bucket policies that grant read and write permissions to the Cognito User Pool client ID, and configure the mobile app to pass the Cognito access token directly to S3 APIs.

Deploy a custom Lambda Authorizer in API Gateway to parse the JSON Web Token, verify the cryptographic signature, and return an IAM policy allowing access to the REST API.

Implement a backend database routine to dynamically provision individual IAM Users and temporary access keys for each authenticated client, storing these access keys on the mobile device's local storage.

Show answer & explanation

Answer: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and map authenticated users to an IAM role that grants access to the S3 bucket using the cognito-identity.amazonaws.com:sub variable in the resource path policy.; Configure an API Gateway Cognito Authorizer on the REST API methods, and configure the mobile app to include the Cognito User Pool identity token in the Authorization header of the requests.

Answer

Create an Amazon Cognito Identity Pool to exchange User Pool tokens for temporary AWS credentials with user-specific S3 paths, and configure an API Gateway Cognito Authorizer to validate the Cognito identity token.

To secure the mobile game progress files in S3 and restrict access to user-specific folders, the developer must use Cognito Identity Pools to exchange User Pool tokens for temporary AWS IAM credentials. By defining an IAM policy using the cognito-identity.amazonaws.com:sub variable, the app enforces path-based access control. Concurrently, to validate incoming User Pool JWT tokens at API Gateway with minimal overhead, the developer should configure the built-in Cognito Authorizer on the REST API resources.

Step-by-Step Solution

Configure user authentication using an Amazon Cognito User Pool.

The mobile app can authenticate users, obtaining JSON Web Tokens (JWTs) including identity and access tokens.

This establishes user identities and handles authentication securely.

Integrate the Amazon Cognito User Pool with API Gateway.

An API Gateway Cognito Authorizer is configured to inspect the Authorization header and validate incoming identity tokens.

This secures API Gateway REST endpoints with minimal operational overhead.

Integrate the Amazon Cognito User Pool with a Cognito Identity Pool.

Authenticated users can exchange their JWTs for temporary AWS IAM credentials.

This allows the mobile client to make direct, secure API calls to Amazon S3.

Apply an IAM role policy to the Identity Pool's authenticated role using the cognito-identity.amazonaws.com:sub variable.

Users are restricted to accessing only S3 objects within their specific folder path.

This ensures data isolation and enforces the principle of least privilege.

Key Concept

Amazon Cognito User Pools handle user directory and authentication, whereas Cognito Identity Pools provide authorization to AWS resources by granting temporary IAM credentials. API Gateway Cognito Authorizers easily validate User Pool JWTs without custom code.

Question 352Question →

A developer is building a serverless web application that utilizes Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for backend services. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them. The solution must validate the JSON Web Tokens (JWTs) provided by the client with the least amount of custom code and lowest operational overhead. Which solution should the developer implement to meet these requirements?

Configure an Amazon Cognito Identity Pool to exchange the User Pool token for temporary AWS credentials, and secure the API Gateway REST API using IAM authorization.

Create a custom API Gateway Lambda Authorizer that fetches the JSON Web Key Set (JWKS), validates the incoming token signature, and returns an IAM policy.

Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.

Set up an API Gateway Lambda Authorizer that checks the user's group membership by making a synchronous DescribeUser API call to the User Pool on every request.

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.

Answer

Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.

Configuring an API Gateway Cognito User Pool Authorizer is the most efficient approach because it is a built-in feature of API Gateway. It automatically validates the identity token passed in the request header against the configured Cognito User Pool client, requiring no custom Lambda function or custom code validation.

Step-by-Step Solution

Identify the primary requirement

The goal is to authorize API Gateway REST API requests using JWTs issued by Amazon Cognito User Pools with minimal custom code and latency.

This establishes the constraints of the system (no custom code, low overhead).

Evaluate the native capabilities of API Gateway

API Gateway features a built-in Cognito User Pool authorizer.

The built-in authorizer natively processes incoming authorization headers containing Cognito tokens without requiring custom Lambda functions or IAM credential exchanges.

Select the optimal configuration

Configure the Cognito Authorizer on the API Gateway method and set the identity source to the Authorization header.

This configuration meets all criteria by delegating JWT validation directly to API Gateway, requiring zero code and incurring no additional execution overhead.

Key Concept

Amazon API Gateway Cognito User Pool Authorizers

Question 353Question →

A company is developing a mobile application that allows users to sign in using their enterprise SAML identity provider. After successful authentication, the mobile application needs to upload user-specific profile images directly to an Amazon S3 bucket, and make secure API calls to a backend REST API hosted on Amazon API Gateway. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads.

Configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.

Configure an Amazon Cognito user pool to generate temporary AWS IAM credentials and attach an IAM policy to the user pool to permit direct S3 uploads.

Create a custom API Gateway Lambda authorizer to extract, decode, and manually validate the signature of the Cognito JSON Web Tokens (JWT) for standard API access.

Create an IAM role with write permissions to the Amazon S3 bucket, hardcode its access keys in the mobile application, and use API Gateway resource policies to control API access.

Show answer & explanation

Answer: Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads.; Configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.

Answer

Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads; and configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.

The correct configurations involve using an Amazon Cognito user pool federated with the SAML provider for authentication, and integrating it with an Amazon Cognito identity pool to supply temporary AWS credentials to the client for Amazon S3 uploads. Additionally, the developer should secure the API Gateway REST API using the built-in Cognito user pool authorizer to validate user tokens.

Step-by-Step Solution

Set up federated authentication with SAML by configuring an Amazon Cognito user pool to manage the user directory.

Users can log in via their enterprise identity provider and receive Cognito JSON Web Tokens (JWTs) representing their authenticated session.

This establishes the identity of the users using the existing SAML identity provider.

Configure an Amazon Cognito identity pool, link the user pool as an identity provider, and map authenticated users to an IAM role with S3 write access.

The client application can exchange the user pool tokens for temporary AWS IAM credentials with permissions restricted to the user's specific S3 folder.

This enables secure direct uploads from the mobile application to S3 without exposing permanent credentials or routing uploads through an intermediary backend.

Configure the API Gateway REST API with a Cognito User Pool Authorizer pointing to the created user pool.

API Gateway automatically intercepts incoming API requests, extracts the authorization header token, and validates it against the user pool before forwarding the request to downstream integrations.

This secures the REST API endpoints using the built-in, low-overhead Cognito authorization mechanism.

Key Concept

Combining Amazon Cognito User Pools for authentication and Identity Pools for AWS resource authorization, alongside built-in API Gateway Cognito Authorizers for securing REST endpoints.

Question 354Question →

A developer is designing a single-page web application where users sign in with their email address and password. After authentication, the application must be able to call a secure backend REST API hosted on Amazon API Gateway and download user-specific profile images directly from a private Amazon S3 bucket. Which two actions should the developer take to meet these requirements with the least operational overhead?

Select all that apply

Configure an Amazon Cognito User Pool to manage user authentication, and use the built-in Cognito User Pool Authorizer in API Gateway to validate the identity token (ID token) presented by the client application.

Configure an Amazon Cognito Identity Pool linked to the User Pool, and map an IAM role to authenticated users that provides read access to the specific Amazon S3 prefix.

Embed IAM user access keys directly inside the client application code, and call the AWS STS AssumeRole API to retrieve credentials for S3 access.

Create a custom Lambda Authorizer in API Gateway that makes a direct query to the Cognito User Pool backend database to verify user credentials on every request.

Configure the S3 Bucket Policy to inspect the HTTP Authorization header and directly validate the JSON Web Tokens (JWTs) generated by the Cognito User Pool.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to manage user authentication, and use the built-in Cognito User Pool Authorizer in API Gateway to validate the identity token (ID token) presented by the client application.; Configure an Amazon Cognito Identity Pool linked to the User Pool, and map an IAM role to authenticated users that provides read access to the specific Amazon S3 prefix.

Answer

Configure an Amazon Cognito User Pool for user authentication alongside a built-in Cognito User Pool Authorizer in API Gateway, and configure an Amazon Cognito Identity Pool to delegate temporary AWS IAM credentials for S3 access.

The correct architecture uses a Cognito User Pool for managing user directories and generating JSON Web Tokens (JWTs) for API Gateway authorization via the built-in Cognito User Pool Authorizer. In addition, an Amazon Cognito Identity Pool maps the authenticated Cognito User Pool identities to temporary AWS IAM credentials, allowing the application to securely download private files directly from Amazon S3.

Step-by-Step Solution

Set up authentication directory

Amazon Cognito User Pool is configured to register and authenticate users via email and password.

This establishes the identity store and handles user sign-in flows.

Secure the API Gateway REST API

API Gateway is configured with a Cognito User Pool Authorizer linked to the User Pool.

This offloads token verification directly to API Gateway without requiring custom Lambda code.

Secure direct S3 access

An Amazon Cognito Identity Pool is created with the User Pool set as the authentication provider, and an authenticated IAM Role is associated with the required S3 read permissions.

This enables the client-side app to exchange the User Pool token for temporary AWS IAM credentials to interact directly with S3.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and API Gateway authorization) and Identity Pools (exchange tokens for temporary AWS IAM credentials for direct AWS service access).

Estimated Time:2m 0s

Question 355Question →

An enterprise web application running on Amazon EC2 instances needs to authenticate with an Amazon RDS for PostgreSQL database. The database password must be rotated every 30 days to comply with security requirements. The developer wants to implement a secure solution that automates the rotation process with the least operational overhead. Which approach should the developer take to meet these requirements?

Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.

Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store. Enable built-in automatic rotation in the Parameter Store settings for RDS and configure a rotation interval of 30 days.

Store the database credentials in a secure configuration file packaged with the application. Initialize the AWS SDK client inside the application by hardcoding temporary IAM user access keys that have permission to read the configuration file.

Store the database password as a standard String parameter in AWS Systems Manager Parameter Store. Use a local cron job on the EC2 instances to retrieve the parameter using hardcoded AWS access keys and rotate the password in the database.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.

Answer

AWS Secrets Manager natively supports automatic rotation of database credentials, including built-in templates for Amazon RDS databases. By enabling rotation and selecting the target RDS database, Secrets Manager automatically updates the database password and the secret value at the specified interval using a managed Lambda function. The application can query Secrets Manager via the AWS SDK at runtime using IAM roles, ensuring it always uses the current credentials without requiring code changes or redeployments.

Step-by-Step Solution

Identify the security requirements: password rotation every 30 days, minimal operational overhead, and secure runtime access by the application.

Recognize that database credential rotation is natively supported by AWS Secrets Manager for Amazon RDS databases, whereas Parameter Store lacks native database rotation integration.

Choosing the service with native rotation integration minimizes custom script maintenance and operational overhead.

Evaluate the credential retrieval method from the application running on EC2.

Ensure the application retrieves the database password dynamically at runtime using the AWS SDK, authenticated via temporary credentials from an IAM instance profile.

Dynamic retrieval ensures the application uses the latest password post-rotation, and IAM instance profiles avoid the security risk of hardcoding AWS access keys.

Key Concept

AWS Secrets Manager native RDS rotation vs Systems Manager Parameter Store configuration

Estimated Time:1m 30s

Question 356Question →

A developer is setting up an AWS CodeBuild project to automate a build pipeline. The project is configured to use a custom service role named CodeBuildServiceRole to access AWS resources. However, when starting a build run, the build fails immediately during the provisioning phase with the following error:

Failed to assume role: CodeBuild is not authorized to perform: sts:AssumeRole on the role CodeBuildServiceRole

The developer examines the trust policy for CodeBuildServiceRole, which contains the following JSON document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification should the developer make to the trust policy to resolve this error?

Attach an IAM permissions policy to the role that grants the sts:AssumeRole action to codebuild.amazonaws.com.

Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.

Configure the buildspec.yml file to define temporary AWS access keys and secret keys under the environment variables section.

Modify the Principal element of the trust policy to use "AWS": "codebuild.amazonaws.com" instead of the Service block.

Show answer & explanation

Answer: Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.

Answer

Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.

The correct action is to update the trust policy's Principal to allow the CodeBuild service (codebuild.amazonaws.com) to assume the role. The error occurs because the trust policy currently only trusts the EC2 service (ec2.amazonaws.com) to assume it.

Step-by-Step Solution

Analyze the error message indicating that CodeBuild is not authorized to assume the role.

Identify that the issue lies in the role's trust relationship rather than the permissions policy.

The error message explicitly points to sts:AssumeRole authorization failure for the CodeBuild service principal.

Examine the role's trust policy document.

Observe that the Principal block currently specifies "Service": "ec2.amazonaws.com".

The role currently trusts only the EC2 service to assume it, preventing other services like CodeBuild from performing the sts:AssumeRole operation.

Modify the Service principal to target the correct service.

Change the Principal to "Service": "codebuild.amazonaws.com".

This establishes a trust relationship that explicitly authorizes the AWS CodeBuild service to assume the role during build execution.

Key Concept

An IAM role requires a trust policy (trust relationship) that designates which principal (e.g., an AWS service like CodeBuild) is allowed to assume the role via the sts:AssumeRole action.

Question 357Question →

A developer is building an AWS Lambda function that integrates with an external customer relationship management (CRM) platform. The integration requires a client secret that must be stored securely and rotated automatically every 30 days. Which solution meets these requirements with the least operational overhead?

Hardcode the client secret in the Lambda function's source code, and use a customer managed key in AWS Key Management Service (AWS KMS) to encrypt the function deployment package.

Store the client secret in AWS Secrets Manager. Configure automatic rotation for the secret by defining a rotation schedule of 30 days and using an AWS Lambda function to perform the rotation.

Store the client secret in AWS Systems Manager Parameter Store as a SecureString parameter. Set up an Amazon EventBridge scheduled rule to trigger a custom AWS Lambda function that updates the parameter value every 30 days.

Store the client secret in AWS Systems Manager Parameter Store as a String parameter, and reference the parameter value directly in the Lambda function's environment variables.

Show answer & explanation

Answer: Store the client secret in AWS Secrets Manager. Configure automatic rotation for the secret by defining a rotation schedule of 30 days and using an AWS Lambda function to perform the rotation.

Answer

Store the client secret in AWS Secrets Manager, and configure automatic rotation for the secret using a 30-day schedule and an AWS Lambda function to execute the rotation.

AWS Secrets Manager is the optimal service for storing sensitive API keys and secrets that require automatic rotation. It features built-in support for rotating secrets on a defined schedule using a Lambda function. This native integration reduces administrative overhead compared to building custom rotation tools.

Step-by-Step Solution

Evaluate the security and rotation requirements for the sensitive CRM client secret.

Identify that the secret must be encrypted and must support automated rotation every 30 days with minimal operational overhead.

This establishes the criteria for selecting between AWS Secrets Manager and Systems Manager Parameter Store.

Compare AWS Secrets Manager and AWS Systems Manager Parameter Store features.

Determine that while Parameter Store supports SecureString parameters, it does not offer built-in rotation functionality. Secrets Manager natively supports automatic rotation via Lambda on a schedule.

This eliminates Parameter Store options due to the lack of built-in rotation capabilities.

Select the correct option based on security best practices.

Store the secret in Secrets Manager and configure automatic rotation.

This fulfills all requirements with the least operational effort.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store rotation capabilities

Question 358Question →

A developer is designing a mobile photo-sharing application that allows users to authenticate using social identity providers. The application must store photos in user-specific folders within an Amazon S3 bucket. Additionally, the application needs to call a secure backend REST API hosted on Amazon API Gateway. Which TWO steps should the developer perform to implement this authentication and authorization flow with the least operational complexity?

Select all that apply

Create an Amazon Cognito User Pool to handle user authentication, federation with social identity providers, and token generation.

Create an Amazon Cognito Identity Pool, integrate it with the User Pool, and map an IAM role to obtain temporary AWS credentials for S3 access.

Configure the Amazon Cognito User Pool to directly issue temporary AWS security credentials to the mobile client for S3 bucket access.

Implement a custom API Gateway Lambda Authorizer that parses the user pool token, assumes an IAM role, and returns temporary security credentials to the client.

Configure the Amazon Cognito Identity Pool to store user attributes, manage password strength policies, and handle multi-factor authentication (MFA).

Show answer & explanation

Answer: Create an Amazon Cognito User Pool to handle user authentication, federation with social identity providers, and token generation.; Create an Amazon Cognito Identity Pool, integrate it with the User Pool, and map an IAM role to obtain temporary AWS credentials for S3 access.

Answer

To implement this flow, the developer should create an Amazon Cognito User Pool to handle user authentication and social provider federation, and create an Amazon Cognito Identity Pool linked to the User Pool to authorize users by providing temporary AWS IAM credentials for S3 access.

For the social identity authentication, the application needs an Amazon Cognito User Pool to serve as the user directory and handle federation. To authorize the client to upload files to Amazon S3, the application must exchange the User Pool tokens for temporary AWS security credentials, which is the primary function of an Amazon Cognito Identity Pool.

Step-by-Step Solution

Set up authentication

Configure an Amazon Cognito User Pool, set up social identity providers, and establish client application settings to receive JWTs upon successful sign-in.

This establishes the identity directory and federated login capabilities for the mobile application.

Set up authorization for AWS resources

Configure an Amazon Cognito Identity Pool, register the User Pool as an identity provider, and associate an IAM role with permissions to the specific S3 folder.

This allows the authenticated user's JWTs to be exchanged for temporary, scoped AWS credentials, granting the client application access to Amazon S3.

Key Concept

Separation of concerns between Cognito User Pools (authentication and user directory) and Cognito Identity Pools (authorization and temporary AWS credentials generation).

Estimated Time:2m 0s

Question 359Question →

A developer is implementing secure client-side uploads for a mobile application. The application must allow authenticated users to upload files to their own prefix in an Amazon S3 bucket named $\text{app-user-data}$ using temporary credentials provided by Amazon Cognito Identity Pools. The target prefix is $\text{cognito/}\$\{cognito-identity.amazonaws.com:sub\}/$ , where $\$\$\{cognito-identity.amazonaws.com:sub\}$ represents the user's Cognito Identity ID.

Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

Select all that apply

In the IAM permissions policy attached to the authenticated role, define the S3 resource path as

\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*

and allow the

\text{s3:PutObject}

action.

Configure the trust policy of the authenticated IAM role to allow the

\text{cognito-identity.amazonaws.com}

service principal to call the

\text{sts:AssumeRoleWithWebIdentity}

action.

Hardcode the AWS credentials of an IAM User with full S3 write permissions inside the mobile application code to initialize the S3 client wrapper.

Add a trust relationship directly to the Amazon S3 bucket policy allowing the

\text{cognito-identity.amazonaws.com}

service principal to assume the bucket's permissions.

Configure the trust policy of the authenticated IAM role to allow the

\text{cognito-idp.amazonaws.com}

service principal to call the

\text{sts:AssumeRole}

action.

Show answer & explanation

Answer: In the IAM permissions policy attached to the authenticated role, define the S3 resource path as $\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*$ and allow the $\text{s3:PutObject}$ action.; Configure the trust policy of the authenticated IAM role to allow the $\text{cognito-identity.amazonaws.com}$ service principal to call the $\text{sts:AssumeRoleWithWebIdentity}$ action.

Answer

Configure the trust policy of the authenticated IAM role to allow the federated principal

\text{cognito-identity.amazonaws.com}

to call the

\text{sts:AssumeRoleWithWebIdentity}

action. Additionally, in the IAM permissions policy attached to this role, allow the

\text{s3:PutObject}

action on the resource path

\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*

To allow client-side users authenticated with Cognito Identity Pools to access AWS resources, the authenticated IAM role must establish a trust relationship with the identity pool provider principal

\text{cognito-identity.amazonaws.com}

and allow the

\text{sts:AssumeRoleWithWebIdentity}

API action. To secure user uploads to S3, the attached permissions policy must grant

\text{s3:PutObject}

access to the user-specific prefix, utilizing the dynamic policy variable

\$\$\{cognito-identity.amazonaws.com:sub\}

to enforce user isolation.

Step-by-Step Solution

Configure the trust policy of the IAM role to permit web identity federation.

The identity pool service principal

\text{cognito-identity.amazonaws.com}

is allowed to assume the role using

\text{sts:AssumeRoleWithWebIdentity}

This establishes trust between Amazon Cognito Identity Pools and the IAM role, enabling the exchange of Cognito tokens for temporary AWS security credentials.

Define dynamic resource-level S3 permissions using Cognito policy variables.

The IAM policy allows

\text{s3:PutObject}

specifically on resource

\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*

The dynamic variable

\$\$\{cognito-identity.amazonaws.com:sub\}

resolves to the current user's unique identity ID at runtime, isolating S3 uploads per user.

Key Concept

Configuring IAM Trust Policies and Identity Pool Variables for Dynamic Resource Isolation

Question 360Question →

A developer is building a web application where users must register and log in to access the system. The application needs to retrieve files from a private Amazon S3 bucket directly from the client browser and invoke private REST APIs hosted on Amazon API Gateway. Which Amazon Cognito configuration will meet these requirements with the least operational overhead?

Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and write a custom API Gateway Lambda Authorizer to manually decode and validate the User Pool JSON Web Tokens (JWTs) to secure the REST APIs.

Use a Cognito Identity Pool to manage user sign-ups, logins, and client federation. Use a Cognito User Pool to generate the temporary AWS credentials required for direct Amazon S3 bucket access, and configure an API Gateway Cognito User Pool Authorizer targeting the Identity Pool to secure the REST APIs.

Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.

Use a Cognito User Pool to manage user sign-ups and logins, and attach an IAM policy directly to User Pool groups to authorize direct Amazon S3 bucket access. Configure an API Gateway Cognito User Pool Authorizer pointing to the groups to secure the REST APIs.

Show answer & explanation

Answer: Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.

Answer

The correct option correctly identifies the separation of concerns: using a Cognito User Pool for user authentication, a Cognito Identity Pool to authorize direct AWS resource access (S3) via temporary credentials, and a built-in Cognito User Pool authorizer to protect the API Gateway endpoints. This represents the most operationally efficient architecture.

Step-by-Step Solution

Identify the authentication directory requirements.

Determine that user registration, sign-in, and profile directory management should be handled by an Amazon Cognito User Pool.

User Pools provide authentication, registration, and directory features for client applications.

Establish a secure mechanism for direct browser-to-S3 access.

Implement an Amazon Cognito Identity Pool configured with the User Pool as an identity provider to vend temporary, limited-privilege AWS credentials via IAM roles.

Identity Pools authorize users to access AWS resources (like S3) directly without exposing long-term credentials or routing requests through an intermediate backend.

Select the most efficient API Gateway authorizer.

Configure a native API Gateway Cognito User Pool Authorizer to secure the REST API endpoints using the tokens issued by the User Pool.

The built-in Cognito authorizer validates JWTs natively, eliminating the need to write, test, and pay for a custom Lambda authorizer function.

Key Concept

Amazon Cognito User Pools vs. Identity Pools, and API Gateway integration.

Estimated Time:1m 30s

PreviousPage 18 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept