Examkin

Amazon Cognito Authentication and Authorization

71 questions

All types71Multiple choice35Multiple select36
Question 1Question →

A developer is building a serverless client-side web application. Users will log in using an Amazon Cognito User Pool. Once authenticated, the application must interact directly with AWS services from the browser to download user-specific documents from an Amazon S3 bucket, restricted to the path `documents/${cognito-identity.amazonaws.com:sub}/*`, and write application usage telemetry directly to an Amazon Kinesis Data Stream. The developer wants to implement this with the least operational overhead and without managing any backend API or compute resources. Which TWO actions should the developer take to configure this solution?

Select all that apply

Show answer & explanation

Answer: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.; Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Answer

The developer should create an Amazon Cognito Identity Pool configured with the User Pool as an identity provider, assigning an authenticated IAM role that permits Kinesis and user-restricted S3 access. Additionally, the client application must exchange the Cognito User Pool ID token for temporary AWS credentials using the Identity Pool.
To interact directly with AWS services like Amazon S3 and Amazon Kinesis from a client-side application, temporary AWS credentials are required. By creating a Cognito Identity Pool and configuring the User Pool as an identity provider, you can exchange the User Pool ID token for temporary AWS IAM credentials. The authenticated IAM role associated with the Identity Pool can restrict S3 access to user-specific folders using the `${cognito-identity.amazonaws.com:sub}` policy variable and grant write permissions to the Kinesis stream, ensuring secure and direct access with minimal operational overhead.

Step-by-Step Solution

1
Configure the user directory and federation.
An Amazon Cognito User Pool is set up for authentication, and an Identity Pool is created with the User Pool configured as an identity provider.
This establishes a trust relationship where successful authentication in the User Pool allows the client to request credentials from the Identity Pool.
2
Define the permissions using an IAM policy on the Identity Pool's authenticated role.
The authenticated IAM role is assigned a policy allowing `s3:GetObject` on `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.
The `${cognito-identity.amazonaws.com:sub}` variable represents the user's Cognito Identity ID, ensuring users can only access their own documents, while Kinesis access allows direct telemetry ingestion.
3
Exchange tokens for credentials in the client application.
The client authenticates with the User Pool, obtains an ID token, and calls the Identity Pool to get temporary AWS credentials.
These credentials are used by the AWS SDK in the browser to sign requests directly to S3 and Kinesis using Signature Version 4.

Key Concept

Amazon Cognito Identity Pools enable client-side applications to obtain temporary, limited-privilege AWS credentials by federating identity providers like Cognito User Pools.
Question 2Question →

A developer is designing a web application dashboard for a smart home IoT system. The application needs to allow users to sign in using their email and password or their social identity provider. Once authenticated, the web application must securely download and upload user-specific configuration files directly from an Amazon S3 bucket. Additionally, the application must invoke backend REST API endpoints hosted on Amazon API Gateway, which should only be accessible to authenticated users.

Which Cognito configuration should the developer choose to satisfy these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure a Cognito User Pool to handle registration, login, and social identity provider federation. Secure the API Gateway REST API with a Cognito Authorizer using the User Pool ID token. Configure a Cognito Identity Pool with the User Pool as an identity provider to obtain temporary AWS credentials for S3 access.

Answer

Configure a Cognito User Pool to handle registration, login, and social identity provider federation. Secure the API Gateway REST API with a Cognito Authorizer using the User Pool ID token. Configure a Cognito Identity Pool with the User Pool as an identity provider to obtain temporary AWS credentials for S3 access.
The correct approach uses an Amazon Cognito User Pool to manage authentication (handling registration, local credentials, and social provider federation) and uses the resulting JSON Web Token (JWT) ID token to authorize API requests via the built-in API Gateway Cognito Authorizer. To access AWS resources like Amazon S3, a Cognito Identity Pool is required to exchange the User Pool tokens for temporary AWS IAM credentials.

Step-by-Step Solution

1
Select Cognito User Pools for user sign-in and management.
Users can register, sign in, and federate through social identity providers to receive JWT tokens.
Cognito User Pools serve as the user directory and handle the authentication flow.
2
Integrate API Gateway with the Cognito User Pool.
API Gateway uses a native Cognito Authorizer to validate incoming ID tokens directly.
This secures the REST API without requiring custom Lambda code or credentials exchange for API calls.
3
Configure a Cognito Identity Pool with the User Pool as a provider.
The client application exchanges the User Pool token for temporary AWS IAM credentials.
These temporary credentials allow the client application to directly and securely upload files to Amazon S3.

Key Concept

Distinction between Cognito User Pools (authentication and user directory) and Cognito Identity Pools (authorization and temporary AWS credentials exchange), as well as integrating User Pools with API Gateway Cognito Authorizers.
Estimated Time:1m 30s
Question 3Question →

A developer is building a web-based reporting dashboard for an enterprise sales team. Users of the dashboard must authenticate using their email and password. Once authenticated, the client application needs to perform two actions: call a secure REST API hosted on Amazon API Gateway to fetch sales metadata, and download raw report files directly from a private Amazon S3 bucket. The developer wants to use Amazon Cognito to implement the authentication and authorization flows. Which TWO configuration steps should the developer perform to meet these requirements with the least administrative and operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set up an Amazon Cognito User Pool to manage user registration and authentication, and configure a Cognito User Pool Authorizer on Amazon API Gateway to secure the REST API.; Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider for it, and map an IAM role with read permissions for the private S3 bucket to authenticated users.

Answer

The developer should set up a Cognito User Pool to manage user registration and login, and secure the API Gateway REST API using the native Cognito User Pool Authorizer. Additionally, the developer should create a Cognito Identity Pool linked to the User Pool to grant temporary AWS credentials for S3 bucket access via an authenticated IAM role.
To authenticate users and secure API Gateway REST APIs with the least overhead, a developer should use an Amazon Cognito User Pool combined with API Gateway's native Cognito User Pool Authorizer. To authorize users to download files directly from Amazon S3, the developer must exchange the Cognito User Pool identity tokens for temporary AWS credentials using a Cognito Identity Pool, which maps users to an IAM role with read permissions for the target S3 bucket.

Step-by-Step Solution

1
Configure the authentication directory and API security.
An Amazon Cognito User Pool is configured to manage user sign-in and sign-up. The API Gateway REST API is protected by selecting Cognito User Pool Authorizer, which natively parses and validates the client's token.
This establishes user identity and protects the REST API with the lowest operational complexity.
2
Configure AWS resource authorization.
An Amazon Cognito Identity Pool is created with the Cognito User Pool configured as an identity provider. An IAM role containing read permissions for the target S3 bucket is attached to the Identity Pool's authenticated role.
This allows authenticated users to obtain temporary AWS credentials for direct, secure interaction with the S3 bucket.

Key Concept

Amazon Cognito User Pools provide authentication and user directories, integrating natively with API Gateway via Cognito Authorizers. Cognito Identity Pools handle authorization by exchanging user identity tokens for temporary AWS credentials to access AWS services directly.
Question 4Question →

A developer is designing a web application hosted on Amazon ECS behind an Application Load Balancer (ALB). The application requires users to authenticate via an Amazon Cognito User Pool. The ALB must authenticate incoming HTTP requests and forward the verified user identity claims to the backend ECS containers without requiring token validation logic inside the container code. Additionally, authenticated users must be able to upload profile images directly from their web client to their own folder within an Amazon S3 bucket. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Add an authenticate action using Cognito to the Application Load Balancer listener rule, which verifies the user session and forwards user claims to the target group in the x-amzn-oidc-data header.; Configure a Cognito Identity Pool using the User Pool as an identity provider, and attach an IAM policy to the authenticated role that grants permission to upload to the resource path arn:aws:s3:::my-bucket/uploads/${cognito-identity.amazonaws.com:sub}/*.

Answer

To meet the requirements, the developer must configure an authenticate action using Cognito on the Application Load Balancer listener rule and set up a Cognito Identity Pool with the User Pool as an identity provider, associating it with an IAM policy that allows access to the user-specific S3 folder path using the identity sub variable.
To offload authentication, the Application Load Balancer listener rule must be configured with an authenticate action using Cognito. The ALB then verifies the tokens and forwards the user information to backend targets via the x-amzn-oidc-data header. For S3 access, the client requires temporary AWS credentials, which are obtained by creating a Cognito Identity Pool that uses the User Pool as an identity provider. The IAM policy attached to the authenticated role uses the ${cognito-identity.amazonaws.com:sub} policy variable to dynamically restrict access to the folder matching the user's Cognito identity ID.

Step-by-Step Solution

1
Identify that the Application Load Balancer needs to offload authentication.
Recognize that ALB supports a native integration with Cognito User Pools using listener rules with an authenticate action.
This avoids having to write custom token validation logic inside the ECS container application code.
2
Determine how the Application Load Balancer passes user identities.
The ALB passes user claims to the targets in HTTP headers such as x-amzn-oidc-data.
This allows the backend application to read claims such as the user ID or email without performing JWT signature checks.
3
Determine how the client can directly upload to S3.
Configure a Cognito Identity Pool to exchange the user pool tokens for temporary credentials.
Since S3 requires AWS IAM credentials and does not natively accept Cognito User Pool tokens, a Cognito Identity Pool must act as the credential provider.
4
Secure the S3 upload path using a policy variable.
Apply an IAM policy to the authenticated role that references ${cognito-identity.amazonaws.com:sub} to restrict each user to their own upload folder.
This dynamically resolves to the Cognito Identity ID of the authenticated user, achieving fine-grained access control.

Key Concept

Integrating Application Load Balancers with Cognito User Pools for authentication and using Cognito Identity Pools for temporary AWS credentials to access S3.
Estimated Time:2m 30s
Question 5Question →

A developer is implementing a serverless analytics dashboard. Users must register and log in to the dashboard, which is built as a single-page application (SPA). The application needs to call secure endpoints on Amazon API Gateway to fetch user profile data. Additionally, the client-side application must publish telemetry logs directly to an Amazon Kinesis Data Stream for real-time analysis. Which TWO steps should the developer perform to meet these security requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Configure a Cognito User Pool to manage user authentication, and create a Cognito User Pool Authorizer in API Gateway to validate the ID tokens sent in the HTTP request headers.; Create a Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with permissions to write to the Kinesis Data Stream.

Answer

To meet the requirements with the least operational overhead, the developer should configure a Cognito User Pool with a Cognito Authorizer in API Gateway to secure the API endpoints, and use a Cognito Identity Pool linked to the User Pool to provide temporary IAM credentials that grant write permissions to the Kinesis Data Stream.
The correct solution uses the native features of AWS services to minimize custom code. By configuring a Cognito User Pool, the developer establishes a user directory. Setting up a Cognito User Pool Authorizer on API Gateway allows the platform to natively inspect and validate the ID tokens. To interact with Amazon Kinesis directly from the client, the developer uses a Cognito Identity Pool to trade the User Pool's JWTs for temporary, restricted AWS IAM credentials, which contain permission to execute the write action on the stream.

Step-by-Step Solution

1
Configure a Cognito User Pool to provide user authentication and management for the single-page application.
The application can authenticate users and receive JSON Web Tokens (ID, Access, and Refresh tokens).
User Pools act as the primary user directory and handle user registration and login flows.
2
Create a Cognito User Pool Authorizer on the API Gateway REST API and configure it to validate the incoming ID tokens in the Authorization header.
API Gateway automatically validates the signature, expiration, and audience of the JWTs without requiring custom Lambda code.
This utilizes the native API Gateway integration to minimize operational overhead and custom code.
3
Set up a Cognito Identity Pool (Federated Identities) and configure the Cognito User Pool as an authentication provider.
The identity pool can federate users authenticated by the user pool and exchange their JWTs for temporary AWS IAM credentials.
Identity Pools are designed to authorize access to AWS resources by issuing temporary AWS credentials.
4
Assign an IAM role to authenticated users in the Identity Pool with a policy that allows the 'kinesis:PutRecord' action on the target stream.
Authenticated users obtain temporary AWS credentials with permissions to publish telemetry logs directly from the browser SDK.
This establishes fine-grained authorization to access AWS resources directly from client-side code.

Key Concept

Integration of Cognito User Pools for user directory authentication, Cognito Identity Pools for authorizing direct AWS resource access (such as S3, DynamoDB, or Kinesis) via temporary credentials, and API Gateway Cognito Authorizers for securing REST endpoints.
Question 6Question →

An enterprise web application requires federated authentication via an external SAML 2.0 Identity Provider (IdP). Once authenticated, users must be able to download files directly from an Amazon S3 bucket. Access must be restricted such that users can only download objects from an S3 prefix that matches their department name (e.g., `company-data/hr/*` for the 'hr' department). The department name is supplied as a custom SAML assertion claim named `department`.

Which configuration should the developer implement to meet these requirements with the least administrative and coding overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool with the SAML IdP. Set up Attribute Mapping to map the SAML `department` claim to the principal tag `department`. In the IAM policy attached to the authenticated role, grant `s3:GetObject` permission for the resource `arn:aws:s3:::company-data/${aws:PrincipalTag/department}/*`.

Answer

Configure an Amazon Cognito Identity Pool with the SAML IdP, map the SAML attribute to the principal tag, and reference the tag in the IAM policy using a policy variable.
The correct option maps the SAML assertion claim to a principal tag in the Cognito Identity Pool configuration. This allows the IAM role to use Attribute-Based Access Control (ABAC) and dynamic policy variables (`${aws:PrincipalTag/department}`) to restrict access to department-specific prefixes in S3 with a single IAM role, minimizing overhead.

Step-by-Step Solution

1
Configure the Identity Pool with the SAML Identity Provider.
This enables federation, allowing Cognito to accept SAML assertions from the external IdP.
Cognito Identity Pools broker access to AWS resources by exchanging external identity tokens for temporary AWS credentials.
2
Set up Attribute Mapping in the Identity Pool.
The `department` claim from the SAML assertion is mapped to the principal tag `department` in the AWS security token context.
This enables Attribute-Based Access Control (ABAC) by attaching the department tag to the assumed IAM role session.
3
Reference the principal tag in the IAM role's permission policy.
A dynamic resource ARN `arn:aws:s3:::company-data/${aws:PrincipalTag/department}/*` is used in the policy.
This allows a single IAM role to scale across multiple departments without requiring manual configuration changes or multiple roles.

Key Concept

Attribute-Based Access Control (ABAC) with Amazon Cognito Identity Pools and SAML federation
Estimated Time:2m 0s
Question 7Question →

An enterprise web application requires external partner users to authenticate using their corporate SAML Identity Provider (IdP). Once authenticated, users must be able to invoke private API endpoints hosted on Amazon API Gateway and upload large log files directly to a specific folder in an Amazon S3 bucket. The S3 folder path must be isolated per partner organization based on a SAML assertion attribute named `partnerId`.

Which combination of configuration steps should a developer implement to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to federate with the corporate SAML IdP, mapping the SAML partnerId assertion to a custom attribute. Set up a Cognito User Pool Authorizer on the API Gateway REST API to secure the private endpoints.; Establish an Amazon Cognito Identity Pool using the User Pool as an identity provider. Use the 'Attributes for access control' feature to map the custom partnerId attribute to a principal tag, and apply an IAM policy on the authenticated role that restricts S3 access using a ${aws:PrincipalTag/partnerId} policy variable.

Answer

Configure an Amazon Cognito User Pool federated with the SAML IdP using a Cognito User Pool Authorizer on API Gateway, and use an Amazon Cognito Identity Pool with Attributes for access control to map the custom partnerId attribute to a principal tag for dynamic S3 path restriction using the policy variable.
The correct solution involves combining Cognito User Pools and Cognito Identity Pools. The User Pool handles SAML federation and custom attribute mapping, allowing API Gateway to natively authorize requests using a Cognito User Pool Authorizer. The Identity Pool exchanges the User Pool tokens for temporary AWS credentials, utilizing the 'Attributes for access control' (ABAC) feature to securely map custom attributes to session principal tags. This lets a single IAM policy restrict S3 bucket paths dynamically using the policy variable, eliminating custom middleware.

Step-by-Step Solution

1
Set up authentication federation using an Amazon Cognito User Pool mapped to the SAML Identity Provider, mapping incoming assertions like partnerId to custom attributes.
Users can authenticate via their corporate credentials, receiving Cognito ID and access JWTs containing their partnerId custom attribute.
Provides a managed directory and token-based identity mechanism without managing credentials.
2
Configure the API Gateway endpoints with an Amazon Cognito User Pool Authorizer that validates the incoming ID/Access token directly.
Requests containing valid tokens are permitted to invoke the backend service, while invalid requests are blocked at the API Gateway layer without invoking backend compute.
Minimizes development effort and compute costs by avoiding custom Lambda validation logic.
3
Create an Amazon Cognito Identity Pool, configure the User Pool as the authentication provider, and enable 'Attributes for access control' mapping the custom partnerId attribute to the principal tag.
The identity pool returns temporary AWS credentials with the principal tag attached to the IAM session.
Allows AWS IAM to evaluate permissions dynamically based on user-specific attributes.
4
Write an IAM policy for the authenticated role referencing the dynamic principal tag variable inside the S3 resource ARN.
A single policy permits uploads only to the folder corresponding to the user's partner ID.
Enforces fine-grained authorization to S3 dynamically with zero-code IAM policy logic.

Key Concept

Federating identities with Cognito User Pools and Identity Pools, using User Pools for API Gateway authorization and Identity Pools with attribute-based access control (ABAC) for temporary AWS credentials.
Question 8Question →

A developer is implementing a custom backend service hosted on Amazon ECS that processes requests from a mobile application. The mobile application authenticates users via an Amazon Cognito User Pool and includes the obtained JSON Web Token (JWT) in the Authorization header of each API request. To minimize latency, the developer wants the backend service to validate these tokens locally rather than making network calls to Amazon Cognito for every incoming request.

Which process should the developer implement to validate the incoming JWTs?

Show answer & explanation

Answer: Download and cache the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, match the token's key ID (kid) to a key in the JWKS, verify the cryptographic signature using the corresponding public key, and validate the token's expiration, audience, and issuer claims.

Answer

The correct process is to download and cache the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, locate the matching public key using the key ID (kid) header, verify the cryptographic signature, and validate the claims locally (expiration, audience, and issuer).
The correct approach is to retrieve the public JSON Web Key Set (JWKS) from the Cognito User Pool's public URI and cache it. When a request arrives, the backend service parses the JWT header to find the key ID (kid), verifies the cryptographic signature with the matching public key, and then verifies the claims locally (expiration, audience, and issuer). This avoids any network call during request processing.

Step-by-Step Solution

1
Retrieve the User Pool's JSON Web Key Set (JWKS) from the well-known public URI.
A collection of public keys that Cognito uses to sign JSON Web Tokens.
The backend service needs the public keys to cryptographically verify the token's signature.
2
Decode the token header to locate the Key ID (kid) and match it against the JWKS.
Identifies the correct public key to use for signature verification.
Cognito rotates signing keys, so the client must match the key ID from the token with the correct public key.
3
Verify the signature and validate claims (expiration, audience, issuer) locally.
Confirmed authenticity and validity of the user's session without making external network calls.
Verifying the claims ensures the token is not expired, was issued by the expected User Pool, and belongs to the correct App Client.

Key Concept

Local validation of Amazon Cognito User Pool JWTs
Estimated Time:1m 30s
Question 9Question →

A developer is building a serverless web application where users sign in using their email and password. Once authenticated, the application must allow users to upload files to a private Amazon S3 bucket and make requests to a backend API hosted on Amazon API Gateway. The developer wants to leverage Amazon Cognito for authentication and authorization. Which TWO configuration steps should the developer perform to meet these requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration and sign-in, and use a Cognito authorizer in Amazon API Gateway to authenticate API requests.; Configure an Amazon Cognito Identity Pool linked to the User Pool, and map Cognito user groups to IAM roles that grant the required Amazon S3 permissions.

Answer

Configure an Amazon Cognito User Pool to handle user registration and sign-in, use a Cognito authorizer in Amazon API Gateway, and configure an Amazon Cognito Identity Pool linked to the User Pool to map user groups to IAM roles for S3 access.
The correct solution involves using a Cognito User Pool to register and authenticate users, generating JWTs. A Cognito Identity Pool is then linked to the User Pool to exchange these JWTs for temporary AWS IAM credentials, which are mapped to specific roles allowing S3 upload access. Finally, the native Cognito authorizer in API Gateway is configured to validate the User Pool's tokens directly, minimizing operational overhead.

Step-by-Step Solution

1
Set up authentication directory.
Created an Amazon Cognito User Pool to manage user sign-up, sign-in, and generate JWT tokens.
User Pools act as the identity provider for user credentials and session management.
2
Establish S3 authorization.
Created an Amazon Cognito Identity Pool, integrated it with the User Pool, and mapped user groups to IAM roles with S3 permissions.
Identity Pools are necessary to vend temporary AWS credentials required for direct S3 API interactions.
3
Configure API Gateway protection.
Configured a Cognito authorizer on the API Gateway REST API endpoints.
Using the built-in Cognito authorizer allows API Gateway to validate User Pool tokens natively without needing custom Lambda code.

Key Concept

Amazon Cognito Authentication and Authorization Integration
Question 10Question →

A developer is migrating a legacy desktop application to a modern cloud-native web application. The application must support federated single sign-on (SSO) using a corporate SAML identity provider. Once users log in, the web client needs to access a private Amazon S3 bucket to retrieve user-specific reports and call a secured Amazon API Gateway HTTP API. Which TWO configurations must the developer implement to meet these requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with a SAML identity provider integration, and configure the API Gateway HTTP API to use a JWT authorizer that validates the User Pool tokens.; Configure an Amazon Cognito Identity Pool that trusts the User Pool, and associate the authenticated IAM role with permissions to read from the target S3 bucket.

Answer

Configure an Amazon Cognito User Pool with a SAML identity provider integration, configure the API Gateway HTTP API to use a JWT authorizer that validates the User Pool tokens, and configure an Amazon Cognito Identity Pool that trusts the User Pool, associating the authenticated IAM role with permissions to read from the target S3 bucket.
To meet the requirements with the least operational overhead, the developer should combine Amazon Cognito User Pools and Identity Pools. The User Pool handles authentication, integrating with the SAML identity provider to authenticate users. For API Gateway HTTP APIs, the built-in JWT authorizer validates the User Pool tokens without requiring custom code. To access Amazon S3, the developer needs an Identity Pool to exchange the authenticated User Pool token for temporary AWS credentials, allowing the web client to perform direct S3 API requests using an IAM role.

Step-by-Step Solution

1
Configure user authentication and identity federation.
Create an Amazon Cognito User Pool, integrate it with the corporate SAML identity provider, and configure the application to redirect users for login.
This establishes the identity directory and federated identity management with the external SAML provider.
2
Implement API Gateway authorization.
Configure a native JWT authorizer on the API Gateway HTTP API pointing to the Cognito User Pool issuer URL.
This secures the HTTP API endpoints by validating the JSON Web Tokens (JWT) issued by Cognito, requiring zero custom Lambda code.
3
Enable secure S3 access.
Create an Amazon Cognito Identity Pool, configure the User Pool as an identity provider, and attach an IAM policy to the authenticated role allowing read permissions to the S3 bucket.
This enables the web client to exchange its Cognito User Pool token for temporary AWS credentials to read reports directly from Amazon S3.

Key Concept

Combining Cognito User Pools for user authentication and API Gateway token validation with Cognito Identity Pools for temporary AWS credential authorization.
Estimated Time:2m 0s
Question 11Question →

A gaming company is developing a new multiplayer dashboard application. The application must authenticate users against an existing, on-premises legacy database containing user credentials without migrating user data to the cloud. Once authenticated, the client application must be able to query leaderboard data directly from an Amazon DynamoDB table and publish telemetry events directly to an Amazon Kinesis Data Stream. Which TWO actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool to support developer authenticated identities (developer provider name) and associate an IAM role for authenticated users with policies allowing access to DynamoDB and Kinesis.; Build a backend authentication service that validates the user's legacy credentials and calls the GetOpenIdTokenForDeveloperIdentity API to return a Cognito identity ID and an OpenID Connect token to the client.

Answer

Configure an Amazon Cognito Identity Pool to support developer authenticated identities (developer provider name) and associate an IAM role for authenticated users with policies allowing access to DynamoDB and Kinesis; and build a backend authentication service that validates the user's legacy credentials and calls the GetOpenIdTokenForDeveloperIdentity API to return a Cognito identity ID and an OpenID Connect token to the client.
The correct options work in tandem to implement Developer Authenticated Identities. The developer-designed backend validates user credentials against the legacy database and uses the GetOpenIdTokenForDeveloperIdentity API to obtain an OpenID Connect token and Cognito identity ID. The client application then uses these to request temporary AWS credentials from the Cognito Identity Pool, which assumes the authenticated IAM role containing the necessary DynamoDB and Kinesis permissions.

Step-by-Step Solution

1
Implement a custom backend service that validates credentials against the legacy database.
The user is authenticated successfully within the company's existing on-premises authentication domain.
Since the legacy credentials cannot be migrated to the cloud, the validation must happen on a secure backend system controlled by the developer.
2
Use the backend service to invoke the Cognito GetOpenIdTokenForDeveloperIdentity API.
Cognito registers the developer-authenticated identity and returns a unique identity ID and an OpenID Connect (OIDC) token to the backend, which forwards them to the client.
This establishes a mapping between the custom user identity and an Amazon Cognito Identity Pool identifier.
3
Configure the Amazon Cognito Identity Pool to trust the developer provider name, and attach an authenticated IAM role with read/write access to DynamoDB and Kinesis.
The client application can call GetCredentialsForIdentity using the OIDC token to retrieve temporary, limited-privilege AWS credentials.
This enables the client application to query DynamoDB and publish to Kinesis directly without passing through a custom API proxy.

Key Concept

Cognito Developer Authenticated Identities (Developer Provider Flow)
Question 12Question →

A developer is implementing a backend service integration for automated partner applications. The partner applications must programmatically upload raw telemetry data directly to an Amazon S3 bucket. The partners authenticate using their own enterprise OpenID Connect (OIDC) identity provider. The developer must ensure that these external applications obtain temporary AWS credentials with permission to write only to a specific folder in the S3 bucket without requiring long-lived IAM user credentials. Which TWO configuration steps should the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create and configure an Amazon Cognito identity pool, specifying the partner's OIDC provider as an authentication provider.; Associate an IAM role containing the required folder-level S3 write permissions with the authenticated identity role of the Cognito identity pool.

Answer

Create and configure an Amazon Cognito identity pool with the external OIDC provider as an authentication provider, and associate an IAM role containing the required folder-level S3 write permissions with the authenticated identity role of the identity pool.
To access AWS resources directly from an external identity provider (such as an OIDC provider), Amazon Cognito identity pools are used to vend temporary AWS credentials. The client first authenticates with the OIDC provider, passes the token to the identity pool, and receives temporary AWS credentials mapped to an IAM role. This role must have a trust policy allowing the identity pool to assume it and an IAM policy with the necessary S3 folder permissions.

Step-by-Step Solution

1
Select Cognito Identity Pools instead of User Pools for AWS resource authorization.
Allows external users to exchange credentials.
Identity pools are designed specifically to vend temporary AWS credentials for direct resource access.
2
Configure the OIDC provider in the identity pool authentication settings.
Enables trust relationship between external OIDC token and AWS STS.
Allows AWS Cognito to validate identity tokens presented by the partner applications.
3
Define an IAM policy with targeted S3 write access and bind it to the IAM role mapped for authenticated users.
Enforces least-privilege folder-level access for the partner applications.
Ensures that the vended temporary credentials only permit uploading to the designated S3 folder.

Key Concept

Amazon Cognito Identity Pools (Federated Identities) for vending temporary AWS credentials to external OIDC-authenticated users.
Estimated Time:2m 0s
Question 13Question →

A developer is implementing a mobile e-commerce application. The application requires a secure user sign-up and sign-in system. Once authenticated, the application must make secure REST API requests to an Amazon API Gateway backend to fetch order history. The developer wants to use a managed user directory and ensure that API Gateway automatically validates the JSON Web Tokens (JWT) sent in the request header without maintaining custom authentication code or custom backend validation logic.

Which setup meets these requirements with the lowest operational complexity?

Show answer & explanation

Answer: Use an Amazon Cognito User Pool to handle user registration and sign-in. Configure a Cognito User Pool Authorizer on the API Gateway REST API method to validate the ID or access token sent by the mobile application.

Answer

Use an Amazon Cognito User Pool to handle user registration and sign-in. Configure a Cognito User Pool Authorizer on the API Gateway REST API method to validate the ID or access token sent by the mobile application.
The correct option is to use an Amazon Cognito User Pool to manage sign-in and sign-up, and configure a Cognito User Pool Authorizer on API Gateway. Cognito User Pools natively handle the user directory and issue JWTs (ID/access tokens) upon authentication. API Gateway's built-in Cognito Authorizer directly validates these JWTs without requiring custom Lambda code, which reduces development effort and operational overhead.

Step-by-Step Solution

1
Determine the service needed for user directory management, registration, and sign-in.
Identify Amazon Cognito User Pools as the service that manages user directories and issues JSON Web Tokens (JWTs) upon successful authentication.
Cognito User Pools serve as the identity provider (IdP) for user management, whereas Identity Pools are used for exchanging tokens for AWS credentials.
2
Evaluate the method for securing the API Gateway REST API using these Cognito tokens without writing custom validation code.
Select the built-in Cognito User Pool Authorizer in API Gateway.
The Cognito User Pool Authorizer natively integrates with API Gateway, extracting and validating the JWT from the request headers automatically, thus eliminating the need for a custom Lambda authorizer.

Key Concept

Amazon Cognito User Pools provide authentication and token issuance, which can be natively validated at API Gateway using a built-in Cognito User Pool Authorizer to secure API endpoints with minimal operational overhead.
Question 14Question →

A developer is building a mobile application that allows users to upload high-resolution photos directly to a private Amazon S3 bucket. The application must authenticate users using an enterprise OpenID Connect (OIDC) identity provider. The developer wants to use Amazon Cognito to facilitate authorization, ensuring that users can only upload files to their own prefix (folder) within the S3 bucket using temporary, least-privilege credentials, without exposing any long-lived credentials. Which TWO configuration steps should the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool and add the OIDC identity provider as an authentication provider in the Identity Pool settings.; Create an IAM role for authenticated users with a trust policy for cognito-identity.amazonaws.com and a permissions policy that utilizes the cognito-identity.amazonaws.com:sub policy variable to grant s3:PutObject access to user-specific prefixes.

Answer

To meet the requirements, the developer must configure an Amazon Cognito Identity Pool with the OIDC provider as an authentication provider, and associate an authenticated IAM role that utilizes the cognito-identity.amazonaws.com:sub policy variable to restrict S3 bucket upload access to the user's specific prefix.
To upload files directly to Amazon S3, a client requires temporary AWS credentials. Amazon Cognito Identity Pools (federated identities) enable this by allowing users to federate with external identity providers (such as an OIDC provider) and obtain temporary AWS credentials. Access to S3 can be scoped to user-specific folders by using the authenticated IAM role associated with the Identity Pool. By incorporating the cognito-identity.amazonaws.com:sub policy variable into the resource block of the IAM role's permission policy, the policy dynamically evaluates to the authenticated user's unique identity ID, thereby enforcing that users can only upload objects to their own folder prefix.

Step-by-Step Solution

1
Set up federation between the OIDC provider and AWS.
Configure an Amazon Cognito Identity Pool and register the OIDC provider within its settings.
This allows users authenticated via the enterprise OIDC provider to exchange their OIDC token for temporary AWS credentials using Cognito.
2
Define authorization permissions using an IAM role.
Create an authenticated IAM role with a trust relationship pointing to cognito-identity.amazonaws.com.
Cognito Identity Pools require an IAM role that defines the permissions granted to authenticated users. The trust policy permits Cognito to assume this role on behalf of the federated user.
3
Implement prefix-level isolation in the IAM permissions policy.
Reference the cognito-identity.amazonaws.com:sub policy variable in the S3 bucket resource ARN (e.g., arn:aws:s3:::my-bucket/${cognito-identity.amazonaws.com:sub}/*).
This dynamically limits each user's S3 put operations to their unique Cognito identity ID, ensuring proper isolation and data security.

Key Concept

Federation using Cognito Identity Pools and access control using Cognito policy variables
Question 15Question →

A developer is implementing a desktop gaming client that needs to authenticate users and allow them to upload gameplay screenshots directly to a private Amazon S3 bucket. The application must also communicate with a backend API hosted on Amazon API Gateway, where endpoints should only be accessible to authenticated users.

Which TWO actions must the developer take to implement this authentication and authorization design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration and authentication, and use the Cognito Authorizer on the API Gateway endpoints.; Configure an Amazon Cognito Identity Pool using the User Pool as an identity provider to obtain temporary AWS credentials for S3 uploads.

Answer

To implement this architecture, configure an Amazon Cognito User Pool to handle user registration and authentication, and use the Cognito Authorizer on the API Gateway endpoints. Additionally, configure an Amazon Cognito Identity Pool using the User Pool as an identity provider to obtain temporary AWS credentials for S3 uploads.
To secure the backend API endpoints, the developer should configure an Amazon Cognito User Pool for user authentication and use the built-in API Gateway Cognito Authorizer, which natively validates JWTs without custom backend code. To enable direct uploads to Amazon S3 without exposing long-term credentials, the developer must configure an Amazon Cognito Identity Pool using the User Pool as an identity provider, which issues temporary AWS credentials with appropriate IAM permissions.

Step-by-Step Solution

1
Set up a Cognito User Pool to manage authentication.
Users can sign up, log in, and receive standard JSON Web Tokens (JWTs) representing their identity.
A User Pool acts as the primary identity provider for the application.
2
Integrate the User Pool with API Gateway.
API Gateway uses the Cognito User Pool Authorizer to inspect the Authorization header and validate the JWTs.
This secures the API endpoints with minimal operational overhead and zero custom code.
3
Set up a Cognito Identity Pool and link it to the User Pool.
The desktop client can exchange User Pool JWTs for temporary, short-lived AWS credentials via IAM roles defined in the Identity Pool.
This allows the client application to upload files directly to S3 securely without hardcoding long-term credentials.

Key Concept

Integration of Amazon Cognito User Pools for authentication and Identity Pools (Federated Identities) for authorizing access to AWS resources like S3.
Question 16Question →

A developer is building a web application that uses Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for the backend. The developer needs to restrict access to a specific API resource so that only users who have a custom user attribute `custom:membership` set to `Gold` can access it. The client application must be able to call the API by passing the Cognito ID token in the `Authorization` header, without having to sign the requests using AWS Signature Version 4. Which solution should the developer implement to meet these requirements?

Show answer & explanation

Answer: Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.

Answer

Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.
The correct solution uses a custom API Gateway Lambda authorizer to decode the Cognito ID token, verify its signature, and inspect the custom membership claim value. Because Cognito ID tokens are JSON Web Tokens (JWTs) that carry custom user attributes in their payload, the Lambda authorizer can perform this check offline without calling Cognito APIs, and then return the appropriate IAM policy to allow or deny access. This achieves the desired authorization logic without requiring the client to perform Signature Version 4 signing.

Step-by-Step Solution

1
Select the API Gateway Lambda authorizer pattern over the built-in Cognito User Pool authorizer.
Enables inspection of custom claims such as custom attributes, which the built-in Cognito authorizer cannot evaluate for custom routing logic.
Built-in Cognito authorizers are limited to token validation and scope checks, making them unsuitable for fine-grained authorization based on custom attributes.
2
Configure the Lambda authorizer to decode and validate the token locally.
Ensures the token is authentic by checking the signature against Cognito's public keys, verifying expiration, and extracting user attributes directly from the payload.
Decoding the token locally prevents slow and rate-limited API calls (like AdminGetUser) to Cognito, optimizing performance and avoiding throttling.
3
Generate and return an IAM policy based on the custom membership claim value.
Returns an IAM Allow policy if the claim value is Gold, or Deny policy otherwise.
API Gateway uses the returned IAM policy to permit or block access to the backend integration.

Key Concept

Fine-grained API Gateway authorization using Cognito ID token claims with a custom Lambda Authorizer.
Question 17Question →

A developer is building a multi-tenant SaaS administration portal. The portal must allow enterprise users to authenticate via their corporate SAML Identity Provider (IdP). Once authenticated, the portal needs to make authorized REST API calls to Amazon API Gateway, where access is controlled based on the user's groups. Additionally, the portal must allow the client application to directly upload diagnostic log files to a tenant-specific folder in a private Amazon S3 bucket.

Which TWO actions should the developer take to implement authentication and authorization for this portal?

Select all that apply

Show answer & explanation

Answer: Create an Amazon Cognito User Pool integrated with the SAML IdP to manage user authentication, and configure an Amazon API Gateway Cognito authorizer to secure the REST API using the ID token.; Create an Amazon Cognito Identity Pool associated with the User Pool, and map the authenticated user identity to an IAM role that grants write permissions to the tenant-specific S3 folder.

Answer

To implement authentication and authorization, the developer must create a User Pool integrated with the SAML IdP and use an API Gateway Cognito authorizer, while also using an Identity Pool to obtain temporary credentials for S3 uploads.
The correct architecture uses a Cognito User Pool for federating with the SAML IdP and managing user login. The ID tokens issued by the User Pool are verified by the API Gateway Cognito authorizer to protect the API. The Identity Pool then exchanges the User Pool tokens for temporary, scoped IAM credentials, enabling the client application to directly upload logs to Amazon S3 securely.

Step-by-Step Solution

1
Configure the authentication layer by creating an Amazon Cognito User Pool.
Allows integration with the external corporate SAML Identity Provider (IdP) to authenticate users and generate standard OIDC tokens (ID and access tokens).
This establishes the identity directory and federates corporate authentication.
2
Secure the Amazon API Gateway REST API endpoints using the Cognito User Pool.
Configuring a Cognito authorizer on the REST API resources validates the ID token passed in the Authorization header.
This enforces API authorization based on Cognito groups and claims without custom Lambda code.
3
Set up the authorization layer for external AWS resources by creating an Amazon Cognito Identity Pool.
Links the Identity Pool to the User Pool as an authentication provider, mapping users to specific IAM roles.
This generates temporary AWS credentials required for direct S3 API interaction from the client web application.

Key Concept

Amazon Cognito User Pools vs Identity Pools integration with API Gateway and S3
Question 18Question →

A company is building a machine-to-machine (M2M) integration that allows an on-premises backend service to programmatically upload raw telemetry data to a private Amazon API Gateway endpoint. The developer needs to secure the API Gateway endpoint using Amazon Cognito. The backend service must authenticate using its credentials, obtain an access token, and use this token to authorize its API requests.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, configure a Cognito User Pool authorizer and set the OAuth scopes on the API method.

Answer

Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, configure a Cognito User Pool authorizer and set the OAuth scopes on the API method.
The correct solution uses an Amazon Cognito User Pool with the client credentials grant to support machine-to-machine authentication. By defining a resource server with custom scopes, the backend service can retrieve a JWT access token. Securing the API Gateway is natively achieved by configuring a built-in Cognito User Pool authorizer and applying the custom OAuth scopes to the API method, which eliminates the need to write custom Lambda code or manage complex developer-authenticated identity flows.

Step-by-Step Solution

1
Set up a Cognito User Pool with a client credentials flow
Created a User Pool, defined a resource server with custom scopes, and enabled the client credentials grant on the app client.
This allows the on-premises machine/service to authenticate programmatically using its client ID and client secret, receiving a standard OAuth 2.0 JSON Web Token (JWT) access token containing the scopes.
2
Configure API Gateway Authorization
Created an API Gateway Cognito User Pool authorizer and associated it with the target API resource methods, specifying the custom OAuth scopes required to invoke them.
This offloads token validation to API Gateway's native authorizer, ensuring that only requests with a valid token containing the correct scopes are allowed to pass through to the backend.

Key Concept

Using Amazon Cognito User Pools for OAuth 2.0 client credentials grant and securing API Gateway with a built-in Cognito authorizer.
Question 19Question →

A developer is designing a mobile multiplayer game. The game client needs to read and write player progress data directly to an Amazon DynamoDB table without routing requests through a custom backend API, to minimize latency and server costs. Players must authenticate using an Amazon Cognito User Pool. The security design requires that players can only access DynamoDB items where the partition key matches their unique Cognito user identifier. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool and set the Amazon Cognito User Pool as the authentication provider. Associate an IAM role with the authenticated users that permits DynamoDB access, using the dynamodb:LeadingKeys condition key set to ${cognito-identity.amazonaws.com:sub} in the IAM policy.

Answer

Configure an Amazon Cognito Identity Pool, configure the User Pool as the identity provider, and apply an IAM policy with a dynamodb:LeadingKeys condition using the Cognito Identity ID.
To access AWS resources directly from a client application using the AWS SDK, the client must obtain temporary AWS credentials. Amazon Cognito Identity Pools (federated identities) are designed for this purpose. They authenticate users via an identity provider (such as an Amazon Cognito User Pool) and exchange the resulting token for temporary AWS credentials associated with an IAM role. Fine-grained access control to DynamoDB is achieved by attaching a policy to the IAM role that uses the dynamodb:LeadingKeys condition key set to the special AWS variable ${cognito-identity.amazonaws.com:sub}, which represents the user's unique Cognito Identity ID.

Step-by-Step Solution

1
Identify the authentication and authorization flow required for direct AWS SDK access from the mobile client.
Recognize that while Cognito User Pools handle user directory and authentication (generating JWT tokens), they do not vend temporary AWS credentials needed by the AWS SDK to sign DynamoDB requests. An Amazon Cognito Identity Pool (federated identities) is required to exchange the User Pool JWT for temporary AWS credentials.
This establishes the identity federation pipeline to obtain valid AWS credentials directly on the client.
2
Configure the Cognito Identity Pool authentication provider.
Link the Cognito User Pool as the authentication provider in the Identity Pool configuration.
This allows the Identity Pool to trust tokens issued by the User Pool and assign an authenticated IAM role to the users.
3
Implement fine-grained access control on the DynamoDB table using IAM policies.
Create an IAM policy for the authenticated user role that grants access to DynamoDB, utilizing the dynamodb:LeadingKeys condition key set to the user's unique Cognito Identity ID: ${cognito-identity.amazonaws.com:sub}.
This dynamically limits the player's access to only the DynamoDB items where the partition key value matches their authenticated Cognito Identity ID, fulfilling the security requirement.

Key Concept

Cognito Identity Pools handle authorization by exchanging authentication tokens for temporary AWS credentials, enabling fine-grained access control to AWS resources via IAM policy variables.
Question 20Question →

A developer is designing a serverless web application where users authenticate via an Amazon Cognito User Pool. The application must meet the following requirements:

1. Access a REST API hosted on Amazon API Gateway, where endpoints must be secured so that only authenticated users can access them with minimal validation latency and zero custom validation code.
2. Upload files directly to an Amazon S3 bucket into a user-specific prefix (s3://app-uploads/\${user_id}/) without routing the files through a backend server.

Which TWO configurations should the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a Cognito User Pool Authorizer on the API Gateway REST API, and pass the Cognito ID token in the request Authorization header.; Create an Amazon Cognito Identity Pool with the User Pool configured as an identity provider, and assign an authenticated IAM role that grants access to the S3 bucket using the \${cognito-identity.amazonaws.com:sub} policy variable.

Answer

Configure a Cognito User Pool Authorizer on the API Gateway REST API, and create a Cognito Identity Pool to obtain temporary AWS credentials mapped to an IAM policy that uses the client's identity ID prefix.
To secure the API Gateway REST API with zero custom code and low latency, a native Cognito User Pool Authorizer is configured to inspect the Authorization header and validate the ID token locally. To authorize direct uploads to S3, a Cognito Identity Pool is required to act as the credential broker. The client exchanges the User Pool token for temporary AWS credentials. By associating the authenticated IAM role of the Identity Pool with a policy that limits access using the identity ID context variable, users are securely restricted to their own folders.

Step-by-Step Solution

1
Select the appropriate authorization mechanism for API Gateway endpoints.
Using the native Cognito User Pool Authorizer validates tokens at the API Gateway edge, meeting the requirement of zero custom code and minimal latency.
This avoids the overhead of managing a custom Lambda authorizer or calling external Cognito APIs on every request.
2
Address the requirement for direct S3 bucket access from the client.
Since S3 does not validate Cognito User Pool JWT tokens directly, temporary AWS credentials must be obtained.
An AWS Identity Pool is required to exchange Cognito User Pool tokens for short-lived IAM credentials.
3
Implement resource isolation for S3 prefixes in the IAM policy.
Associate the authenticated role of the Identity Pool with an IAM policy that grants permission to the S3 bucket using the context variable for the Cognito identity ID.
This ensures users can only write to their own folder path using the unique identity pool subject identifier.

Key Concept

Integrating Amazon Cognito User Pools for API Gateway authentication and Cognito Identity Pools for S3 authorization.
Estimated Time:3m 0s
Page 1 / 4Next