Examkin

Amazon Cognito Authentication and Authorization

71 questions

All types71Multiple choice35Multiple select36
Question 41Question →

An enterprise web application requires users to sign in using their corporate Identity Provider (IdP) via SAML 2.0. After successful authentication, the web application must access tenant-specific folders in an Amazon S3 bucket directly from the browser. Additionally, the application must make authorized calls to a backend REST API hosted on Amazon API Gateway. The developer wants to minimize custom coding for token validation and credential exchange. Which architecture configuration satisfies these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs. Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider to obtain temporary IAM credentials for S3 access. Secure the REST API using an API Gateway Cognito Authorizer that validates the User Pool tokens.

Answer

Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs, use an Amazon Cognito Identity Pool to obtain temporary IAM credentials for S3 access, and secure the REST API using an API Gateway Cognito Authorizer that validates User Pool tokens.
The correct option correctly uses Cognito User Pools to handle federation and authentication via SAML 2.0, Cognito Identity Pools to exchange user identity for temporary IAM credentials for S3 access, and the native API Gateway Cognito Authorizer to secure backend API requests. This aligns perfectly with the responsibilities of each Cognito component and achieves the requirements with the least operational and development overhead.

Step-by-Step Solution

1
Configure SAML federation in Cognito User Pool
Users can authenticate against the corporate IdP via SAML 2.0, and Cognito User Pool issues ID, access, and refresh tokens.
This establishes user identity and directory management using the existing corporate IdP.
2
Integrate Cognito Identity Pool with the User Pool
The application can exchange the Cognito User Pool ID token for temporary AWS IAM credentials.
This enables secure, direct access to S3 without exposing static AWS credentials or routing S3 uploads through a backend proxy.
3
Configure API Gateway with a Cognito User Pool Authorizer
API Gateway automatically validates incoming Cognito User Pool tokens to authorize REST API requests.
This secures the REST API using built-in platform capabilities, avoiding the overhead of custom Lambda validation code.

Key Concept

Integration of Cognito User Pools (authentication & token issuance), Cognito Identity Pools (temporary AWS credentials for direct resource access), and API Gateway Cognito Authorizers (token-based API security).
Question 42Question →

A developer is building a web application that stores user-specific files in a private Amazon S3 bucket. The application uses an Amazon Cognito User Pool for user authentication. The developer wants to authorize users to access their department's files in S3 using temporary AWS credentials. The user's department is stored in a custom attribute named custom:department in the User Pool. The developer has created a separate IAM role for each department. Which approach should the developer use to assign the correct IAM role to each user with the least operational overhead?

Show answer & explanation

Answer: Create an Amazon Cognito Identity Pool and add the User Pool as an identity provider. Configure rules-based role mapping on the identity provider to match the custom:department claim in the ID token to the corresponding IAM role.

Answer

Create an Amazon Cognito Identity Pool, add the User Pool as an identity provider, and configure rules-based role mapping on the identity provider to match the custom:department claim in the ID token to the corresponding IAM role.
The correct solution uses an Amazon Cognito Identity Pool to exchange the ID token from the User Pool for temporary AWS credentials. By configuring rules-based role mapping on the User Pool identity provider within the Identity Pool, the developer can inspect the custom:department claim present in the authenticated user's ID token and dynamically assign the corresponding department-specific IAM role. This requires zero custom code and leverages native AWS features, minimizing operational overhead.

Step-by-Step Solution

1
Identify the separation of concerns between Amazon Cognito User Pools and Identity Pools.
Confirm that User Pools handle authentication (user sign-in and profile attributes) while Identity Pools handle authorization (exchanging tokens for temporary AWS credentials).
Since the client needs direct access to S3, temporary AWS credentials must be vended via an Identity Pool.
2
Determine how to map the custom attribute from the User Pool to the required IAM role.
Leverage the rules-based role mapping feature of Cognito Identity Pools.
Rules-based mapping allows evaluating the custom:department claim from the ID token and dynamically assigning one of the pre-created department-specific IAM roles.
3
Eliminate options that introduce unnecessary custom code or rely on unsupported policy variables.
Reject solutions involving custom Lambda authorizers on API Gateway or unsupported Cognito Identity Pool policy variables.
These alternatives increase operational complexity and fail to utilize the built-in, native integrations of Amazon Cognito.

Key Concept

Role mapping in Amazon Cognito Identity Pools based on Cognito User Pool ID token claims
Question 43Question →

A developer is building a single-page web application (SPA) that will allow users to authenticate using Amazon Cognito User Pools and access backend services through Amazon API Gateway. Since the SPA runs entirely in the user's browser, the client credentials cannot be kept secure. The developer wants to implement a secure authentication flow using the authorization code grant with Proof Key for Code Exchange (PKCE) and validate access at the API Gateway layer. Which TWO steps should the developer take to implement this architecture?

Select all that apply

Show answer & explanation

Answer: Configure the Amazon Cognito User Pool app client with client secret generation disabled, and enable the Authorization Code Grant OAuth flow.; Create an Amazon API Gateway Cognito User Pool authorizer to validate the signature and expiration of the identity or access tokens passed in the Request header.

Answer

The correct steps are to configure the user pool app client without a client secret while enabling the authorization code grant flow, and to create an API Gateway Cognito User Pool authorizer to validate incoming tokens.
The correct options state that the Cognito User Pool app client must be configured with client secret generation disabled while enabling the authorization code grant flow, and that a built-in API Gateway Cognito User Pool authorizer should be created to validate the tokens. For public clients like single-page applications running in the browser, exposing a client secret is a security risk. Therefore, client secret generation is disabled, and PKCE is utilized to secure the authorization code grant. API Gateway's native Cognito authorizer can automatically validate the JWT signature, issuer, and expiration locally using public keys from the User Pool's JSON Web Key Set (JWKS), minimizing overhead.

Step-by-Step Solution

1
Disable client secret generation for the app client.
The client application (SPA) can safely initiate the authentication flow without needing to store or protect a secret.
Single-page applications run entirely in the browser, making it impossible to protect client secrets. Using the authorization code grant with PKCE mitigates the need for a client secret.
2
Enable the Authorization Code Grant flow in the Cognito app client settings.
Cognito is configured to exchange authorization codes for access and identity tokens securely.
This OAuth grant type, combined with PKCE, is the industry standard for securing public web applications.
3
Configure an Amazon API Gateway Cognito User Pool authorizer.
API Gateway automatically intercepts requests, validates the signature and expiration of the JWTs, and permits or denies access.
This native integration validates JSON Web Tokens (JWTs) locally using Cognito's public key set, removing the need for a custom Lambda authorizer and reducing latency.

Key Concept

Securing public clients and verifying tokens using Amazon Cognito User Pools and API Gateway native authorizers.
Question 44Question →

A developer is implementing a smart home mobile application. The mobile client needs to authenticate users and obtain temporary, limited-privilege AWS credentials to publish telemetry data directly to Amazon IoT Core MQTT topics.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Authenticate users using an Amazon Cognito User Pool. Configure an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials associated with an IAM role that permits publishing to AWS IoT Core.

Answer

Authenticate users using an Amazon Cognito User Pool. Configure an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials associated with an IAM role that permits publishing to AWS IoT Core.
Using an Amazon Cognito User Pool for user authentication combined with an Amazon Cognito Identity Pool to exchange tokens for temporary AWS credentials is the standard, built-in AWS pattern. The Identity Pool handles the generation of temporary credentials via an IAM role with minimum operational overhead.

Step-by-Step Solution

1
Use Amazon Cognito User Pools for user sign-up and sign-in management.
Users are authenticated, and the mobile client receives JSON Web Tokens (JWTs).
Cognito User Pools serve as the identity provider to verify user identities.
2
Configure an Amazon Cognito Identity Pool and associate it with the Cognito User Pool as an authentication provider.
The client application can present the User Pool tokens to the Identity Pool in exchange for temporary AWS credentials.
Cognito Identity Pools provide authorization to AWS resources by vending temporary AWS credentials.
3
Assign an IAM role with permissions to publish to AWS IoT Core MQTT topics to the authenticated user role in the Identity Pool.
The mobile client uses the obtained temporary credentials to interact securely and directly with AWS IoT Core.
This implements the principle of least privilege using short-lived credentials, minimizing security risks and administrative overhead.

Key Concept

Amazon Cognito User Pools handle authentication (user directory and tokens), whereas Cognito Identity Pools handle authorization by exchanging those tokens for temporary AWS credentials.
Estimated Time:1m 30s
Question 45Question →

A developer is building a serverless web application that allows users to access corporate resources through a backend REST API hosted on Amazon API Gateway and powered by AWS Lambda. The developer has configured an Amazon Cognito User Pool to handle user authentication. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them, and the backend Lambda function must retrieve the authenticated user's email address to record audit logs. The solution must minimize custom code and operational overhead.

Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pools authorizer on the API methods, specifying the Cognito User Pool as the identity source.; Use a Lambda proxy integration and access the user's email address from the requestContext.authorizer.claims.email field in the input event.

Answer

Configure an API Gateway Cognito User Pools authorizer on the API methods, specifying the Cognito User Pool as the identity source, and use a Lambda proxy integration to access the user's email address from the requestContext.authorizer.claims.email field in the input event.
The correct options implement the most efficient serverless pattern: using API Gateway's native Cognito User Pools authorizer to authenticate users and validate tokens at the API gateway layer, and then passing the identity claims to the backend Lambda function via the Lambda proxy integration's requestContext. This requires zero custom authorizer code and minimal backend logic to extract the user's email.

Step-by-Step Solution

1
Select Cognito User Pools as the authentication mechanism for API Gateway.
API Gateway validates tokens natively using the built-in Cognito authorizer.
This minimizes operational overhead by avoiding the need to write custom authorization logic.
2
Enable Lambda proxy integration for the API Gateway integration.
The entire HTTP request context, including authorizer metadata, is passed to the backend Lambda function.
API Gateway automatically populates the authorizer claims in the request event context, enabling the Lambda function to read the user's email.

Key Concept

API Gateway Cognito User Pool Authorizer integration with Lambda Proxy
Estimated Time:2m 0s
Question 46Question →

A company is creating a customer portal where registered users can log in and view their monthly account statements. These statements are stored in a private Amazon S3 bucket. The developer needs to implement a solution that authenticates users, manages their accounts, and provides them with temporary, limited-privilege AWS credentials to download their statements directly from S3.

Which Amazon Cognito configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.

Answer

Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.
The correct solution uses a Cognito User Pool to handle registration and authentication (acting as the user directory and producing identity tokens) and exchanges these tokens via a Cognito Identity Pool to obtain temporary AWS credentials with permissions to retrieve files from the Amazon S3 bucket.

Step-by-Step Solution

1
Identify the authentication and user management component.
Amazon Cognito User Pool is selected to act as the user directory and handle user registration, login, and token generation.
User Pools are designed to manage user identities, profiles, and authentication flows.
2
Identify the authorization component for accessing AWS services.
Amazon Cognito Identity Pool is selected to act as the credential broker.
Identity Pools exchange identity tokens (JWTs) from a User Pool (or other identity providers) for temporary, limited-privilege AWS credentials.
3
Define IAM permissions for the authenticated role.
Associate the authenticated IAM role in the Identity Pool with an IAM policy that allows read access to the specific S3 bucket.
This grants the temporary credentials the necessary permission to access the private S3 objects.

Key Concept

Cognito User Pools handle authentication (user directory), while Cognito Identity Pools handle authorization (temporary AWS credentials for AWS services).
Question 47Question →

A developer is building an enterprise web application. The application must authenticate corporate users using an external SAML 2.0 Identity Provider (IdP) and provide them with access to two resources: a secure REST API hosted on Amazon API Gateway, and a private Amazon S3 bucket for uploading reports directly from the client.

Which TWO configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with the external SAML Identity Provider (IdP) to handle user authentication, and set up an API Gateway Cognito Authorizer using the User Pool's tokens.; Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with write permissions to the Amazon S3 bucket.

Answer

Configure an Amazon Cognito User Pool with the external SAML Identity Provider (IdP) to handle user authentication, and set up an API Gateway Cognito Authorizer using the User Pool's tokens. In addition, configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with write permissions to the Amazon S3 bucket.
The correct architecture uses an Amazon Cognito User Pool to federate authentication with the SAML Identity Provider (IdP) and secures the API Gateway using a Cognito Authorizer with the generated JWT. It also uses an Amazon Cognito Identity Pool (Federated Identities) to exchange the User Pool JWT for temporary AWS credentials defined by an authenticated IAM role, enabling the client application to upload reports directly to Amazon S3.

Step-by-Step Solution

1
Federate SAML 2.0 IdP with Cognito User Pool
Users can authenticate against the corporate directory, and Cognito User Pool issues ID and access JWT tokens to the client.
This establishes user identity and generates tokens to verify the user's session.
2
Secure the API Gateway REST API with a Cognito User Pool Authorizer
API Gateway automatically validates the Cognito JWT token on incoming requests.
This verifies that the caller has been authenticated by the User Pool before forwarding the request to downstream services.
3
Configure a Cognito Identity Pool linked to the User Pool
The Identity Pool validates the User Pool ID token and maps the authenticated user to an IAM role.
This enables the exchange of the Cognito JWT for temporary, limited-privilege AWS credentials (access key, secret key, session token) which are required to write objects directly to the Amazon S3 bucket.

Key Concept

Integration of Cognito User Pools for user directory/federation and Cognito Identity Pools for temporary AWS credential delegation.
Question 48Question →

A developer is building a web application where users sign in via social identity providers. The application needs to call a backend REST API on Amazon API Gateway, and also allow users to upload user profile photos directly to a private Amazon S3 bucket.

Which Cognito configuration meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure a Cognito User Pool to handle user sign-in and social provider federation. Secure the REST API using an API Gateway Cognito user pool authorizer. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to authorize direct S3 uploads.

Answer

Configure a Cognito User Pool to handle user sign-in and social provider federation. Secure the REST API using an API Gateway Cognito user pool authorizer. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to authorize direct S3 uploads.
The correct configuration uses a Cognito User Pool for user sign-in and identity federation, securing API Gateway endpoints using a built-in Cognito authorizer which natively validates the JSON Web Tokens (JWTs). It then uses a Cognito Identity Pool to trade the authenticated User Pool token for temporary AWS IAM credentials, allowing the application client to perform direct uploads to S3 with minimal operational overhead.

Step-by-Step Solution

1
Identify the authentication and user management component.
A Cognito User Pool is selected to manage user profiles, sign-ins, and social identity provider federation.
User Pools act as the primary user directory and issue identity tokens.
2
Select the API authorization mechanism.
Use the built-in API Gateway Cognito user pool authorizer to validate the JWTs sent by the client.
This integration handles token validation automatically with zero custom code or Lambda overhead.
3
Determine how the client obtains credentials for direct S3 access.
Configure a Cognito Identity Pool that trusts the Cognito User Pool, allowing the client to exchange its user token for temporary AWS IAM credentials.
Amazon S3 requires AWS IAM credentials for secure client-side uploads, which is the primary purpose of Identity Pools.

Key Concept

Federating user sign-in with Cognito User Pools and obtaining temporary AWS credentials via Cognito Identity Pools for S3 access.
Question 49Question →

A developer is designing a collaborative document editing web application. The application authenticates users using an Amazon Cognito User Pool. The backend APIs are hosted on Amazon API Gateway. The developer wants to restrict access to a specific API Gateway resource method (POST /documents) so that only users belonging to the 'Editors' Cognito User Pool group can invoke it.

Which TWO configurations would allow the developer to implement this group-based authorization?

Select all that apply

Show answer & explanation

Answer: Configure the API Gateway resource method to use AWS_IAM authorization. Configure an Amazon Cognito Identity Pool to map Cognito User Pool groups to distinct IAM roles, and configure the application to sign the API requests with the temporary credentials obtained from the Identity Pool.; Create an API Gateway Lambda Authorizer. Program the Lambda function to validate the User Pool JWT token, extract the cognito:groups claim, and dynamically generate an IAM policy that grants or denies execution permissions for the method based on the group membership.

Answer

The developer can implement group-based authorization by configuring the API Gateway method to use AWS_IAM authorization combined with a Cognito Identity Pool mapping groups to IAM roles, or by implementing an API Gateway Lambda Authorizer that inspects the cognito:groups claim inside the JWT token to generate a dynamic IAM policy.
Group-based authorization in Amazon API Gateway cannot be natively enforced using only the built-in Cognito User Pool authorizer. To restrict resource access to specific Cognito groups, two approaches are valid. The first is to set up a Cognito Identity Pool that maps User Pool groups to distinct IAM roles, secure the API Gateway methods with AWS_IAM, and have the client sign requests using temporary credentials. The second is to implement an API Gateway Lambda Authorizer. This custom authorizer validates the token, extracts the group claims from the token's claims, and outputs an IAM policy that allows or denies the execution of the requested method.

Step-by-Step Solution

1
Determine where the authorization check should occur.
Authorization should occur at the API Gateway layer before invoking backend resources to avoid unnecessary invocation costs and latency.
This rules out executing database checks or calling identity administration APIs inside the backend integration.
2
Evaluate Cognito Identity Pools role-mapping.
Cognito Identity Pools allow mapping Cognito User Pool groups directly to IAM roles. These roles contain policies that permit or deny actions on API Gateway resource methods (execute-api:Invoke).
The client uses these mapped roles to obtain temporary AWS credentials and signs the HTTP request to API Gateway.
3
Evaluate custom Lambda Authorizers.
A Lambda Authorizer intercepts API requests, decodes the JWT token sent by the client, reads the groups from the token payload, and constructs a standard IAM policy dynamically.
This provides fine-grained control directly in code without requiring clients to obtain temporary AWS credentials.

Key Concept

Amazon Cognito Group-Based API Authorization
Estimated Time:1m 30s
Question 50Question →

A developer is building a command-line interface (CLI) tool that internal engineers will use to upload software builds directly to a private Amazon S3 bucket. The engineers authenticate with the company's external OpenID Connect (OIDC) identity provider. The CLI tool needs to obtain temporary AWS credentials to write to the S3 bucket directly.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool, register the OIDC identity provider, and link it to an IAM role that grants write access to the S3 bucket.

Answer

Configure an Amazon Cognito Identity Pool, register the OIDC identity provider, and link it to an IAM role that grants write access to the S3 bucket.
The correct configuration uses an Amazon Cognito Identity Pool to federate with the OIDC identity provider. This pool directly exchanges OIDC tokens for temporary AWS IAM credentials, allowing the CLI tool to call the Amazon S3 PutObject API directly using an associated IAM role with minimum operational overhead and no custom code.

Step-by-Step Solution

1
Determine the authentication source and the authorization target.
The CLI authentication is managed by an external OpenID Connect (OIDC) identity provider, and the target is Amazon S3, which requires AWS IAM credentials.
Establishing the input and output requirements helps choose the right Cognito resource.
2
Differentiate between Cognito User Pools and Identity Pools for AWS resource authorization.
Cognito User Pools manage user directory and authentication tokens (JWTs), while Cognito Identity Pools exchange external identity tokens for temporary AWS credentials.
Since the CLI tool must authenticate directly to Amazon S3 using AWS credentials, an Identity Pool is the required service.
3
Select the configuration that minimizes custom integration and operational overhead.
Configuring a Cognito Identity Pool to map OIDC users to an IAM role is a native, serverless configuration requiring zero custom code.
This meets the objective of minimizing operational overhead and avoiding unnecessary intermediate proxies.

Key Concept

Amazon Cognito Identity Pools (Federated Identities) are used to exchange credentials from external identity providers (such as OIDC, SAML, or social IdPs) for temporary, limited-privilege AWS credentials to directly access AWS resources like Amazon S3.
Question 51Question →

A developer is building a serverless mobile application for fitness tracking. The application needs to authenticate users using an external OpenID Connect (OIDC) identity provider. Once authenticated, the application must allow users to call an Amazon API Gateway REST API and upload workout logs directly to their own private folders in an Amazon S3 bucket. Which TWO configurations should the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Set up an Amazon Cognito User Pool and federate it with the OIDC identity provider. Configure the API Gateway REST API to use a Cognito authorizer linked to the User Pool.; Set up an Amazon Cognito Identity Pool and configure the Cognito User Pool as an identity provider. Associate an authenticated IAM role with the Identity Pool that allows s3:PutObject for the uploads/\${cognito-identity.amazonaws.com:sub}/ prefix.

Answer

To meet the requirements, the developer must configure an Amazon Cognito User Pool federated with the OIDC provider to authenticate users and secure the API Gateway REST API with a Cognito authorizer. Additionally, the developer must configure an Amazon Cognito Identity Pool with the User Pool as an identity provider, associating an IAM role that grants permissions to the user's S3 folder using the cognito-identity.amazonaws.com:sub variable.
The correct approach integrates both Cognito User Pools and Identity Pools. The User Pool handles OIDC authentication and issues JWT tokens, which the API Gateway Cognito Authorizer verifies. The Identity Pool then takes the User Pool ID token and exchanges it for temporary IAM credentials. The attached IAM policy uses the dynamic variable to restrict S3 uploads to the authenticated user's prefix.

Step-by-Step Solution

1
Federate the OIDC provider with a Cognito User Pool and configure the API Gateway Cognito Authorizer.
Users can log in using their OIDC identity, and the User Pool will issue JWT tokens that API Gateway validates natively.
This establishes user authentication and secures the API Gateway backend without custom authorization code.
2
Configure a Cognito Identity Pool using the User Pool as an authentication provider.
The client app can exchange the User Pool tokens for temporary AWS IAM credentials.
This bridges user authentication with AWS resource authorization.
3
Attach a fine-grained IAM policy to the authenticated role of the Cognito Identity Pool.
The IAM policy allows s3:PutObject only to the prefix uploads/\${cognito-identity.amazonaws.com:sub}/.
This restricts users so they can only write files to their own individual S3 folders using secure temporary credentials.

Key Concept

Integrating Amazon Cognito User Pools for user authentication/federation and Cognito Identity Pools for authorizing direct access to AWS resources like Amazon S3 using temporary AWS credentials.
Question 52Question →

A software engineer is configuring security for a web application where clients send requests to a REST API hosted on Amazon API Gateway. The application uses an Amazon Cognito User Pool for user authentication. The engineer must restrict access to the REST API so that only authenticated users with a valid JSON Web Token (JWT) can call the endpoints, without writing custom code to decode or validate the tokens. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito authorizer on the API Gateway REST API, referencing the User Pool, and pass the identity token in the request header.

Answer

Configure an Amazon Cognito authorizer on the API Gateway REST API, referencing the User Pool, and pass the identity token in the request header.
The correct solution uses an API Gateway Cognito authorizer linked to the Amazon Cognito User Pool. This is a built-in feature that automatically validates incoming JWT tokens (such as the ID token) without requiring any custom Lambda code, meeting all constraints with the lowest operational overhead.

Step-by-Step Solution

1
Identify the requirement to authenticate users using Amazon Cognito User Pools and authorize access to API Gateway without custom code.
Confirm that user identity validation must occur at the API Gateway layer without custom validation logic.
This helps narrow down the solutions to native integration options on API Gateway.
2
Evaluate built-in API Gateway authorizers and note that a Cognito Authorizer natively integrates with Cognito User Pools to validate tokens automatically.
Determine that the Amazon Cognito authorizer is the built-in mechanism designed for this specific scenario.
Using a native feature avoids the development and operational overhead of custom code or identity pools.
3
Pass the identity token (ID token) or access token generated by the User Pool in the request header (commonly Authorization) to the Cognito authorizer.
API Gateway automatically decodes, verifies, and validates the incoming token against the configured User Pool.
This ensures only authenticated clients with valid tokens are allowed to invoke the backend service.

Key Concept

API Gateway integration with Amazon Cognito User Pools using Cognito Authorizers
Estimated Time:1m 30s
Question 53Question →

A developer is implementing a secure report retrieval feature for a corporate intranet portal. The portal's users authenticate using an Amazon Cognito User Pool. Once authenticated, the portal's client-side application needs to download private reports directly from an Amazon S3 bucket. To optimize performance and cost, the architecture must not route the file downloads through an intermediate API Gateway or Lambda function. The solution must grant users direct, short-lived access to the reports using the least privilege principle.

Which TWO configuration steps should the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool and add the Cognito User Pool as an identity provider.; Attach an IAM policy granting s3:GetObject permissions to the IAM role associated with authenticated users in the Identity Pool.

Answer

Configure an Amazon Cognito Identity Pool and add the Cognito User Pool as an identity provider, and attach an IAM policy granting s3:GetObject permissions to the IAM role associated with authenticated users in the Identity Pool.
To authorize authenticated Cognito User Pool users to directly access private S3 resources, the developer must configure an Amazon Cognito Identity Pool that lists the User Pool as its identity provider. The developer must then attach an IAM policy granting s3:GetObject permissions to the authenticated IAM role of the Identity Pool. This allows the client-side application to obtain short-lived AWS credentials containing the necessary permissions to retrieve files directly from S3 without passing through intermediate compute layers.

Step-by-Step Solution

1
Configure the identity directory
Ensure users authenticate via the Amazon Cognito User Pool, which validates credentials and issues JSON Web Tokens (JWTs).
Provides the initial authentication mechanism and user directory.
2
Set up federated authorization
Create an Amazon Cognito Identity Pool and register the Cognito User Pool ID/App Client ID as the identity provider.
Establishes a mechanism to exchange identity tokens (JWTs) for temporary AWS credentials.
3
Configure IAM permissions
Attach an IAM policy with s3:GetObject permission for the target S3 bucket to the Identity Pool's authenticated IAM role.
Ensures that the client application receives credentials authorized to retrieve reports directly from S3.

Key Concept

Amazon Cognito Authentication and Authorization using User Pools and Identity Pools
Estimated Time:2m 0s
Question 54Question →

A developer is designing a web application that uses Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for the backend. The API endpoints must be secured so that only users with an 'Active' subscription can access them. The subscription status is stored in an external Amazon DynamoDB table and updated in real-time, which prevents it from being stored as a static attribute in the Cognito ID or access tokens. Which solution should the developer implement to secure the API Gateway endpoints?

Show answer & explanation

Answer: Implement an API Gateway Lambda Authorizer that validates the incoming Cognito token, queries the DynamoDB table to verify the user's subscription status, and returns an IAM policy to allow or deny the request.

Answer

Implement an API Gateway Lambda Authorizer that validates the incoming Cognito token, queries the DynamoDB table to verify the user's subscription status, and returns an IAM policy to allow or deny the request.
An API Gateway Lambda Authorizer allows custom authorization logic. In this scenario, it can parse and validate the Cognito token to authenticate the user, query DynamoDB to check the real-time subscription status, and dynamically generate an IAM policy that allows or denies access to the API resources.

Step-by-Step Solution

1
Analyze the authentication and authorization requirements.
Authentication is handled by Cognito User Pools (JWT tokens are provided to the client). Authorization requires a real-time check against an external DynamoDB table.
Determines whether the built-in Cognito Authorizer is sufficient or if a custom authorization mechanism is required.
2
Evaluate the capabilities of the native Cognito User Pool Authorizer.
The native authorizer can only validate token signatures, expiration, and audience. It cannot perform external lookups or query DynamoDB.
Eliminates solutions relying solely on the built-in Cognito User Pool Authorizer for dynamic database checks.
3
Select and configure an API Gateway Lambda Authorizer.
The Lambda Authorizer receives the token, decodes and validates it, queries DynamoDB for the real-time subscription status, and returns an IAM policy.
Provides the custom validation logic needed to satisfy the real-time subscription requirement before the request reaches the backend.

Key Concept

Using API Gateway Lambda Authorizers for custom, dynamic authorization checks that cannot be performed by built-in Cognito Authorizers.
Estimated Time:1m 30s
Question 55Question →

An IoT startup is developing a dashboard web application that allows users to authenticate using external social providers (Google and Apple) via Amazon Cognito. Once authenticated, the web application must interact with two backend systems:
1. Make authenticated requests to an Amazon API Gateway HTTP API that manages dashboard configurations.
2. Directly publish sensor telemetry data to an Amazon Kinesis Data Stream.

Which TWO configurations must the developer implement to secure access to these resources? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool federated with Google and Apple, and set up an Amazon API Gateway JWT authorizer that validates the identity tokens issued by the User Pool.; Configure an Amazon Cognito Identity Pool that integrates with the User Pool as an identity provider, and associate an IAM role with the authenticated identities that grants kinesis:PutRecord permissions.

Answer

To secure the HTTP API, configure a User Pool federated with Google and Apple and use an API Gateway JWT authorizer. To authorize direct Kinesis writes, configure an Identity Pool that exchanges User Pool tokens for temporary AWS credentials with the required IAM policy.
Setting up a Cognito User Pool with Google and Apple federation allows the application to authenticate users and receive JSON Web Tokens (JWTs). These JWTs can be natively validated by an API Gateway HTTP API JWT authorizer. An Identity Pool takes the token from the authenticated User Pool session and exchanges it for temporary AWS credentials via an IAM role, which allows the application to directly call the Kinesis API.

Step-by-Step Solution

1
Determine how to authenticate users via Google and Apple and secure API Gateway HTTP API routes.
Identify that an Amazon Cognito User Pool acts as the user directory and identity provider (IdP), and that API Gateway HTTP APIs can use a native JWT authorizer to validate the issued token.
User Pools handle authentication and federation with social providers, while API Gateway JWT authorizers offer low-latency, built-in validation of these user pool tokens.
2
Determine how the client application can write to the Amazon Kinesis Data Stream directly.
Identify that the client needs temporary AWS credentials authorized via an IAM role to call the Kinesis API.
Cognito Identity Pools exchange Cognito User Pool tokens for temporary AWS security credentials, enabling direct, secure client access to AWS resources like Kinesis.
3
Associate the IAM role with the correct Cognito construct.
Configure the Cognito Identity Pool with the authenticated IAM role containing the kinesis:PutRecord policy.
This maps authenticated users to the specific AWS IAM policy required to publish telemetry data to Kinesis.

Key Concept

Distinguishing and integrating Amazon Cognito User Pools for user authentication and Identity Pools for AWS resource authorization.
Estimated Time:2m 0s
Question 56Question →

A developer is building a corporate portal where employees must sign in using their existing SAML 2.0 Identity Provider (IdP) credentials. The portal's backend API, hosted on Amazon API Gateway, requires custom user claims such as department and employee ID to perform fine-grained authorization. Which configuration will meet these requirements with the least development effort?

Show answer & explanation

Answer: Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to the corresponding user pool attributes, and configure API Gateway to use a Cognito User Pool authorizer.

Answer

Configure the SAML 2.0 IdP as a federated identity provider in a Cognito User Pool, map the SAML assertions to the corresponding user pool attributes, and configure API Gateway to use a Cognito User Pool authorizer.
Configuring the SAML 2.0 IdP within a Cognito User Pool and mapping its assertions to user pool attributes allows the identity directory to generate JWT ID/access tokens containing the custom claims. Using the native Cognito User Pool authorizer in API Gateway validates these tokens automatically, presenting the claims to the backend integration with minimal configuration and no custom code.

Step-by-Step Solution

1
Set up a Cognito User Pool and add the SAML 2.0 IdP as a federated provider using the IdP's metadata document.
Cognito User Pool is established as the directory that federates authentication to the external corporate SAML IdP.
This establishes the identity provider trust relationship and configures the user authentication source.
2
Configure SAML attribute mapping in Cognito User Pool settings to map incoming SAML assertions (e.g., department, employee ID) to standard or custom user pool attributes.
The federated user's identity tokens generated by Cognito (ID token and Access token) will automatically contain these mapped claims.
This ensures the backend API can access the required custom claims in the authorization payload.
3
Configure an API Gateway Cognito User Pool Authorizer on the API methods, referencing the user pool.
API Gateway automatically validates the incoming ID token sent in the Authorization header and passes the claims to the backend integration context.
This performs token validation and supplies the custom claims to the API with zero custom code or Lambda execution overhead.

Key Concept

Amazon Cognito User Pools support SAML 2.0 federation and direct attribute mapping, allowing standard API Gateway Cognito Authorizers to automatically validate tokens and pass mapped claims to backend integrations without custom Lambda code.
Question 57Question →

A developer is building a mobile gaming application that requires authenticated users to save their game progress files directly to an Amazon S3 bucket. The game progress files must be stored in a folder path specific to each user. Additionally, the application needs to call a secure REST API hosted on Amazon API Gateway to post high scores. The developer wants to use Amazon Cognito for authentication and authorization with the least operational overhead.

Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and map authenticated users to an IAM role that grants access to the S3 bucket using the cognito-identity.amazonaws.com:sub variable in the resource path policy.; Configure an API Gateway Cognito Authorizer on the REST API methods, and configure the mobile app to include the Cognito User Pool identity token in the Authorization header of the requests.

Answer

Create an Amazon Cognito Identity Pool to exchange User Pool tokens for temporary AWS credentials with user-specific S3 paths, and configure an API Gateway Cognito Authorizer to validate the Cognito identity token.
To secure the mobile game progress files in S3 and restrict access to user-specific folders, the developer must use Cognito Identity Pools to exchange User Pool tokens for temporary AWS IAM credentials. By defining an IAM policy using the cognito-identity.amazonaws.com:sub variable, the app enforces path-based access control. Concurrently, to validate incoming User Pool JWT tokens at API Gateway with minimal overhead, the developer should configure the built-in Cognito Authorizer on the REST API resources.

Step-by-Step Solution

1
Configure user authentication using an Amazon Cognito User Pool.
The mobile app can authenticate users, obtaining JSON Web Tokens (JWTs) including identity and access tokens.
This establishes user identities and handles authentication securely.
2
Integrate the Amazon Cognito User Pool with API Gateway.
An API Gateway Cognito Authorizer is configured to inspect the Authorization header and validate incoming identity tokens.
This secures API Gateway REST endpoints with minimal operational overhead.
3
Integrate the Amazon Cognito User Pool with a Cognito Identity Pool.
Authenticated users can exchange their JWTs for temporary AWS IAM credentials.
This allows the mobile client to make direct, secure API calls to Amazon S3.
4
Apply an IAM role policy to the Identity Pool's authenticated role using the cognito-identity.amazonaws.com:sub variable.
Users are restricted to accessing only S3 objects within their specific folder path.
This ensures data isolation and enforces the principle of least privilege.

Key Concept

Amazon Cognito User Pools handle user directory and authentication, whereas Cognito Identity Pools provide authorization to AWS resources by granting temporary IAM credentials. API Gateway Cognito Authorizers easily validate User Pool JWTs without custom code.
Question 58Question →

A developer is building a serverless web application that utilizes Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for backend services. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them. The solution must validate the JSON Web Tokens (JWTs) provided by the client with the least amount of custom code and lowest operational overhead. Which solution should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.

Answer

Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.
Configuring an API Gateway Cognito User Pool Authorizer is the most efficient approach because it is a built-in feature of API Gateway. It automatically validates the identity token passed in the request header against the configured Cognito User Pool client, requiring no custom Lambda function or custom code validation.

Step-by-Step Solution

1
Identify the primary requirement
The goal is to authorize API Gateway REST API requests using JWTs issued by Amazon Cognito User Pools with minimal custom code and latency.
This establishes the constraints of the system (no custom code, low overhead).
2
Evaluate the native capabilities of API Gateway
API Gateway features a built-in Cognito User Pool authorizer.
The built-in authorizer natively processes incoming authorization headers containing Cognito tokens without requiring custom Lambda functions or IAM credential exchanges.
3
Select the optimal configuration
Configure the Cognito Authorizer on the API Gateway method and set the identity source to the Authorization header.
This configuration meets all criteria by delegating JWT validation directly to API Gateway, requiring zero code and incurring no additional execution overhead.

Key Concept

Amazon API Gateway Cognito User Pool Authorizers
Question 59Question →

A company is developing a mobile application that allows users to sign in using their enterprise SAML identity provider. After successful authentication, the mobile application needs to upload user-specific profile images directly to an Amazon S3 bucket, and make secure API calls to a backend REST API hosted on Amazon API Gateway. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads.; Configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.

Answer

Configure an Amazon Cognito user pool with SAML federation for user authentication, and associate it with an Amazon Cognito identity pool to obtain temporary AWS credentials for Amazon S3 uploads; and configure the API Gateway REST API to use a Cognito user pool authorizer to validate the ID or access tokens sent by the application.
The correct configurations involve using an Amazon Cognito user pool federated with the SAML provider for authentication, and integrating it with an Amazon Cognito identity pool to supply temporary AWS credentials to the client for Amazon S3 uploads. Additionally, the developer should secure the API Gateway REST API using the built-in Cognito user pool authorizer to validate user tokens.

Step-by-Step Solution

1
Set up federated authentication with SAML by configuring an Amazon Cognito user pool to manage the user directory.
Users can log in via their enterprise identity provider and receive Cognito JSON Web Tokens (JWTs) representing their authenticated session.
This establishes the identity of the users using the existing SAML identity provider.
2
Configure an Amazon Cognito identity pool, link the user pool as an identity provider, and map authenticated users to an IAM role with S3 write access.
The client application can exchange the user pool tokens for temporary AWS IAM credentials with permissions restricted to the user's specific S3 folder.
This enables secure direct uploads from the mobile application to S3 without exposing permanent credentials or routing uploads through an intermediary backend.
3
Configure the API Gateway REST API with a Cognito User Pool Authorizer pointing to the created user pool.
API Gateway automatically intercepts incoming API requests, extracts the authorization header token, and validates it against the user pool before forwarding the request to downstream integrations.
This secures the REST API endpoints using the built-in, low-overhead Cognito authorization mechanism.

Key Concept

Combining Amazon Cognito User Pools for authentication and Identity Pools for AWS resource authorization, alongside built-in API Gateway Cognito Authorizers for securing REST endpoints.
Question 60Question →

A developer is designing a single-page web application where users sign in with their email address and password. After authentication, the application must be able to call a secure backend REST API hosted on Amazon API Gateway and download user-specific profile images directly from a private Amazon S3 bucket. Which two actions should the developer take to meet these requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to manage user authentication, and use the built-in Cognito User Pool Authorizer in API Gateway to validate the identity token (ID token) presented by the client application.; Configure an Amazon Cognito Identity Pool linked to the User Pool, and map an IAM role to authenticated users that provides read access to the specific Amazon S3 prefix.

Answer

Configure an Amazon Cognito User Pool for user authentication alongside a built-in Cognito User Pool Authorizer in API Gateway, and configure an Amazon Cognito Identity Pool to delegate temporary AWS IAM credentials for S3 access.
The correct architecture uses a Cognito User Pool for managing user directories and generating JSON Web Tokens (JWTs) for API Gateway authorization via the built-in Cognito User Pool Authorizer. In addition, an Amazon Cognito Identity Pool maps the authenticated Cognito User Pool identities to temporary AWS IAM credentials, allowing the application to securely download private files directly from Amazon S3.

Step-by-Step Solution

1
Set up authentication directory
Amazon Cognito User Pool is configured to register and authenticate users via email and password.
This establishes the identity store and handles user sign-in flows.
2
Secure the API Gateway REST API
API Gateway is configured with a Cognito User Pool Authorizer linked to the User Pool.
This offloads token verification directly to API Gateway without requiring custom Lambda code.
3
Secure direct S3 access
An Amazon Cognito Identity Pool is created with the User Pool set as the authentication provider, and an authenticated IAM Role is associated with the required S3 read permissions.
This enables the client-side app to exchange the User Pool token for temporary AWS IAM credentials to interact directly with S3.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and API Gateway authorization) and Identity Pools (exchange tokens for temporary AWS IAM credentials for direct AWS service access).
Estimated Time:2m 0s
PreviousPage 3 / 4Next