Amazon Cognito Authentication and Authorization

71 questions

All types71 Multiple choice35 Multiple select36

A developer is designing a mobile photo-sharing application that allows users to authenticate using social identity providers. The application must store photos in user-specific folders within an Amazon S3 bucket. Additionally, the application needs to call a secure backend REST API hosted on Amazon API Gateway. Which TWO steps should the developer perform to implement this authentication and authorization flow with the least operational complexity?

Select all that apply

Create an Amazon Cognito User Pool to handle user authentication, federation with social identity providers, and token generation.

Create an Amazon Cognito Identity Pool, integrate it with the User Pool, and map an IAM role to obtain temporary AWS credentials for S3 access.

Configure the Amazon Cognito User Pool to directly issue temporary AWS security credentials to the mobile client for S3 bucket access.

Implement a custom API Gateway Lambda Authorizer that parses the user pool token, assumes an IAM role, and returns temporary security credentials to the client.

Configure the Amazon Cognito Identity Pool to store user attributes, manage password strength policies, and handle multi-factor authentication (MFA).

Show answer & explanation

Answer: Create an Amazon Cognito User Pool to handle user authentication, federation with social identity providers, and token generation.; Create an Amazon Cognito Identity Pool, integrate it with the User Pool, and map an IAM role to obtain temporary AWS credentials for S3 access.

Answer

To implement this flow, the developer should create an Amazon Cognito User Pool to handle user authentication and social provider federation, and create an Amazon Cognito Identity Pool linked to the User Pool to authorize users by providing temporary AWS IAM credentials for S3 access.

For the social identity authentication, the application needs an Amazon Cognito User Pool to serve as the user directory and handle federation. To authorize the client to upload files to Amazon S3, the application must exchange the User Pool tokens for temporary AWS security credentials, which is the primary function of an Amazon Cognito Identity Pool.

Step-by-Step Solution

Set up authentication

Configure an Amazon Cognito User Pool, set up social identity providers, and establish client application settings to receive JWTs upon successful sign-in.

This establishes the identity directory and federated login capabilities for the mobile application.

Set up authorization for AWS resources

Configure an Amazon Cognito Identity Pool, register the User Pool as an identity provider, and associate an IAM role with permissions to the specific S3 folder.

This allows the authenticated user's JWTs to be exchanged for temporary, scoped AWS credentials, granting the client application access to Amazon S3.

Key Concept

Separation of concerns between Cognito User Pools (authentication and user directory) and Cognito Identity Pools (authorization and temporary AWS credentials generation).

Estimated Time:2m 0s

Question 62Question →

A developer is building a web application where users must register and log in to access the system. The application needs to retrieve files from a private Amazon S3 bucket directly from the client browser and invoke private REST APIs hosted on Amazon API Gateway. Which Amazon Cognito configuration will meet these requirements with the least operational overhead?

Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and write a custom API Gateway Lambda Authorizer to manually decode and validate the User Pool JSON Web Tokens (JWTs) to secure the REST APIs.

Use a Cognito Identity Pool to manage user sign-ups, logins, and client federation. Use a Cognito User Pool to generate the temporary AWS credentials required for direct Amazon S3 bucket access, and configure an API Gateway Cognito User Pool Authorizer targeting the Identity Pool to secure the REST APIs.

Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.

Use a Cognito User Pool to manage user sign-ups and logins, and attach an IAM policy directly to User Pool groups to authorize direct Amazon S3 bucket access. Configure an API Gateway Cognito User Pool Authorizer pointing to the groups to secure the REST APIs.

Show answer & explanation

Answer: Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.

Answer

The correct option correctly identifies the separation of concerns: using a Cognito User Pool for user authentication, a Cognito Identity Pool to authorize direct AWS resource access (S3) via temporary credentials, and a built-in Cognito User Pool authorizer to protect the API Gateway endpoints. This represents the most operationally efficient architecture.

Step-by-Step Solution

Identify the authentication directory requirements.

Determine that user registration, sign-in, and profile directory management should be handled by an Amazon Cognito User Pool.

User Pools provide authentication, registration, and directory features for client applications.

Establish a secure mechanism for direct browser-to-S3 access.

Implement an Amazon Cognito Identity Pool configured with the User Pool as an identity provider to vend temporary, limited-privilege AWS credentials via IAM roles.

Identity Pools authorize users to access AWS resources (like S3) directly without exposing long-term credentials or routing requests through an intermediate backend.

Select the most efficient API Gateway authorizer.

Configure a native API Gateway Cognito User Pool Authorizer to secure the REST API endpoints using the tokens issued by the User Pool.

The built-in Cognito authorizer validates JWTs natively, eliminating the need to write, test, and pay for a custom Lambda authorizer function.

Key Concept

Amazon Cognito User Pools vs. Identity Pools, and API Gateway integration.

Estimated Time:1m 30s

Question 63Question →

An engineering team is designing a client-side web application that integrates with an external OpenID Connect (OIDC) identity provider. Once authenticated, the web application must upload session logs directly to a specific folder within an Amazon S3 bucket (e.g., logs/{user_id}/). To minimize transfer latency and backend compute costs, the logs must be uploaded directly from the browser. Which architecture meets these requirements with the least operational overhead?

Create an IAM Role with a trust policy that allows the sts:AssumeRole action for the client application. Hardcode the IAM Role ARN in the client application, and have the client call AWS STS directly to assume the role using the OIDC token.

Configure an Amazon Cognito Identity Pool, register the OIDC provider as an authentication provider, and assign an authenticated IAM role. Use an IAM policy for this role that grants S3 write permissions to resources matching arn:aws:s3:::my-bucket/logs/${cognito-identity.amazonaws.com:sub}/*.

Configure an Amazon Cognito User Pool, register the OIDC provider as a federated Identity Provider (IdP), and configure a custom attribute to map the user ID to S3 folder access. Use the User Pool ID token directly to authenticate and authorize the client's S3 uploads.

Create an Amazon API Gateway REST API with a custom Lambda Authorizer. Have the authorizer validate the OIDC tokens, call AWS Security Token Service (STS) to generate temporary credentials, and return these credentials to the client to perform the S3 uploads.

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool, register the OIDC provider as an authentication provider, and assign an authenticated IAM role. Use an IAM policy for this role that grants S3 write permissions to resources matching arn:aws:s3:::my-bucket/logs/${cognito-identity.amazonaws.com:sub}/*.

Answer

Using an Amazon Cognito Identity Pool is the standard, least-overhead method to exchange external OIDC identity tokens for temporary, limited-privilege AWS credentials. The identity pool acts as the credential provider, mapping the OIDC token to an authenticated IAM role. By using the policy variable ${cognito-identity.amazonaws.com:sub}, you can dynamically restrict users to their specific folders within the S3 bucket without requiring custom backend code.

Step-by-Step Solution

Configure an Amazon Cognito Identity Pool and configure it to trust the external OIDC identity provider.

Enables the client-side application to present OIDC tokens to Cognito in exchange for a unique Cognito Identity ID.

Identity Pools are the service component responsible for federating identity providers to authorize AWS resource access.

Assign an authenticated IAM role to the Identity Pool, representing signed-in users.

Users who present valid OIDC tokens will automatically assume this role and receive temporary AWS credentials.

IAM roles define what permissions the authenticated identity has within the AWS environment.

Apply a policy to the IAM role that uses the dynamic variable ${cognito-identity.amazonaws.com:sub} in the S3 resource ARN.

Enforces fine-grained isolation, ensuring users can only write to their own folder within the S3 bucket.

This avoids hardcoding or managing individual folders manually, providing secure and automated resource isolation.

Key Concept

Amazon Cognito Identity Pools broker temporary AWS credentials for federated users, allowing direct and secure access to AWS resources like S3 using dynamic policy variables.

Estimated Time:1m 30s

Question 64Question →

A developer is building a mobile health-tracking application. Users will log in using an external OpenID Connect (OIDC) compliant identity provider. After logging in, the mobile application must upload raw telemetry log files directly to a private Amazon S3 bucket, and invoke a private REST API hosted on Amazon API Gateway to fetch user profile data. Which TWO Amazon Cognito configurations are required to support this architecture?

Select all that apply

A Cognito User Pool federated with the OIDC identity provider to handle user authentication and issue identity and access tokens.

A Cognito Identity Pool configured to accept the OIDC-federated tokens and assume an IAM role for temporary AWS credentials to upload files to Amazon S3.

A Cognito User Pool group with an attached IAM role configured to directly authorize the client application to put objects into the S3 bucket.

An API Gateway Lambda Authorizer configured to validate the OIDC tokens and generate temporary AWS credentials for the S3 bucket access.

An API Gateway Cognito Authorizer configured to validate the OIDC tokens and return temporary AWS credentials to the mobile client.

Show answer & explanation

Answer: A Cognito User Pool federated with the OIDC identity provider to handle user authentication and issue identity and access tokens.; A Cognito Identity Pool configured to accept the OIDC-federated tokens and assume an IAM role for temporary AWS credentials to upload files to Amazon S3.

Answer

To support this architecture, the developer must configure a Cognito User Pool federated with the OIDC identity provider to handle user authentication, and a Cognito Identity Pool to exchange the OIDC tokens for temporary AWS credentials to write to the Amazon S3 bucket.

To authenticate users through an external OIDC identity provider and obtain user directory tokens (such as identity or access tokens), a Cognito User Pool must be configured with federation. To allow the mobile application to upload files directly to a private S3 bucket without routing through a server, a Cognito Identity Pool is required to exchange the OIDC-federated tokens for temporary, limited-privilege AWS credentials.

Step-by-Step Solution

Configure a Cognito User Pool with the OIDC identity provider as an external identity provider.

The User Pool validates OIDC authentication and issues identity, access, and refresh tokens to the mobile application.

A User Pool acts as the user directory and manages federation for user sign-in.

Configure a Cognito Identity Pool (Federated Identities) with the Cognito User Pool as an authentication provider.

The Identity Pool exchanges the OIDC-federated tokens for temporary, limited-privilege AWS credentials.

An Identity Pool is required to translate external identity tokens into IAM roles and temporary credentials for direct access to AWS resources like S3.

Key Concept

Distinction and integration between Amazon Cognito User Pools (authentication) and Cognito Identity Pools (authorization for AWS resources).

Question 65Question →

A developer is implementing authentication and authorization for a mobile retail shopping application. The application needs to allow users to sign up and sign in, make authorized calls to a backend order processing API hosted on Amazon API Gateway, and upload scan logs directly to a private Amazon S3 bucket. Which architecture meets these requirements with the least operational overhead?

Configure a Cognito User Pool to handle user registration and login. Set up a Cognito Authorizer on Amazon API Gateway to validate the tokens generated by the User Pool. Configure a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS IAM credentials to authorize direct S3 uploads.

Configure a Cognito Identity Pool to manage user registration and authentication. Set up a custom Lambda Authorizer on Amazon API Gateway to validate the session state, and use Cognito User Pool groups to authorize direct S3 uploads.

Configure a Cognito User Pool to handle user registration and login. Create a custom API Gateway Lambda Authorizer that parses the user identity from the User Pool, generates temporary IAM credentials, and returns them to the client to authorize S3 uploads and API calls.

Configure a Cognito User Pool to handle user registration. Write a custom IAM trust policy on the Amazon S3 bucket that allows direct write access based on the User Pool client ID, and use an API Gateway resource policy to authenticate API requests.

Show answer & explanation

Answer: Configure a Cognito User Pool to handle user registration and login. Set up a Cognito Authorizer on Amazon API Gateway to validate the tokens generated by the User Pool. Configure a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS IAM credentials to authorize direct S3 uploads.

Answer

The correct solution leverages Cognito User Pools to authenticate users and generate JSON Web Tokens (JWTs). These tokens are verified directly by API Gateway using a built-in Cognito Authorizer, which requires no custom coding. To allow the mobile application to upload files directly to Amazon S3 without exposing static credentials or passing data through a backend, a Cognito Identity Pool is used to exchange the User Pool tokens for temporary, short-lived AWS IAM credentials.

Step-by-Step Solution

Select Amazon Cognito User Pools for authentication.

Enables user signup, signin, and directory management, producing JSON Web Tokens (JWTs) upon successful authentication.

User Pools are built specifically for identity management and authentication.

Configure API Gateway with a native Cognito Authorizer.

Enables API Gateway to validate User Pool tokens automatically without custom code or running a Lambda function.

Minimizes operational overhead and cost compared to custom Lambda authorizers.

Configure a Cognito Identity Pool (Federated Identities).

Allows authenticated User Pool users to exchange their tokens for temporary AWS credentials mapped to an IAM role with S3 write permissions.

Identity Pools are the standard AWS mechanism to authorize users for direct access to AWS resources like Amazon S3.

Key Concept

Cognito User Pools handle authentication (identity directory), while Cognito Identity Pools handle authorization (temporary AWS credentials for direct resource access). API Gateway Cognito Authorizers natively validate User Pool tokens.

Question 66Question →

A developer is building a client proofing portal for a photography studio. The portal must authenticate clients using email and password, allow them to upload selection feedback files directly to a secure Amazon S3 bucket, and access private backend APIs on Amazon API Gateway. Which TWO actions must the developer take to configure the authentication and authorization flow?

Select all that apply

Set up a Cognito User Pool to handle user registration and sign-in, and configure a Cognito User Pool Authorizer on API Gateway to secure the APIs.

Set up a Cognito Identity Pool that uses the User Pool as an identity provider to obtain temporary AWS credentials for S3 bucket uploads.

Set up a Cognito User Pool to generate temporary AWS credentials for S3 uploads using Cognito Sync.

Create a custom API Gateway Lambda Authorizer that decodes and validates the Cognito User Pool identity tokens to authorize API calls.

Create a Cognito Identity Pool to store user profiles and authenticate users directly via email and password.

Show answer & explanation

Answer: Set up a Cognito User Pool to handle user registration and sign-in, and configure a Cognito User Pool Authorizer on API Gateway to secure the APIs.; Set up a Cognito Identity Pool that uses the User Pool as an identity provider to obtain temporary AWS credentials for S3 bucket uploads.

Answer

To configure the authentication and authorization flow, the developer must set up a Cognito User Pool to manage authentication and secure the API Gateway using a Cognito User Pool Authorizer, and set up a Cognito Identity Pool referencing the User Pool to obtain temporary AWS credentials for S3 uploads.

The system requires a Cognito User Pool to handle user directory registration, login, and token generation. The backend APIs are secured with minimal complexity by using the native Cognito User Pool Authorizer on API Gateway. Direct uploads to Amazon S3 are enabled by exchanging the user token for temporary AWS credentials via a Cognito Identity Pool, which assumes an authenticated IAM role with the necessary S3 permissions.

Step-by-Step Solution

Configure a Cognito User Pool.

Establishes a user directory for client registration and authentication, issuing identity and access tokens (JWTs) upon successful login.

A User Pool is required to manage credentials and handle user sign-in.

Create a Cognito User Pool Authorizer on Amazon API Gateway.

API Gateway validates the token automatically for incoming requests without requiring custom code.

Using the native Cognito Authorizer reduces operational overhead and simplifies API security.

Create a Cognito Identity Pool and link it to the User Pool.

The client application can exchange User Pool tokens for temporary AWS credentials mapped to an IAM role with S3 write permissions.

An Identity Pool is necessary to delegate temporary AWS access for direct interaction with S3.

Key Concept

Amazon Cognito User Pools vs. Identity Pools and API Gateway Authorization

Question 67Question →

A developer is building a personal finance application. Users must be able to sign up, sign in, and access secured REST API endpoints on Amazon API Gateway. Additionally, users must be able to upload scanned monthly statements directly to a private Amazon S3 bucket. Which architecture meets these requirements with the least operational overhead?

Use an Amazon Cognito User Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and use an Amazon Cognito Identity Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.

Use an Amazon Cognito Identity Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and use an Amazon Cognito User Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.

Use an Amazon Cognito User Pool for user registration and authentication, write a custom Lambda authorizer to manually parse and validate the Cognito JSON Web Tokens (JWT) for the API endpoints, and use an Amazon Cognito Identity Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.

Use an Amazon Cognito User Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and configure the application client with an IAM user's long-term access keys to handle the Amazon S3 uploads.

Show answer & explanation

Answer: Use an Amazon Cognito User Pool for user registration and authentication, configure an API Gateway Cognito user pool authorizer to secure the API endpoints, and use an Amazon Cognito Identity Pool to grant authenticated users temporary AWS credentials for the Amazon S3 uploads.

Answer

The correct architecture uses a Cognito User Pool to handle user registration and login, an API Gateway Cognito user pool authorizer to secure REST API endpoints with no coding effort, and a Cognito Identity Pool to dynamically exchange user pool tokens for temporary IAM credentials that authorize the client application to upload files directly to S3.

Step-by-Step Solution

Set up user authentication and directory services.

Create an Amazon Cognito User Pool to manage user registration, sign-in, and user attributes.

A User Pool serves as a user directory and issues JSON Web Tokens (JWT) upon successful authentication.

Protect the REST API endpoints in API Gateway.

Create a built-in Cognito User Pool authorizer in API Gateway and configure the API methods to require this authorizer.

Using the built-in Cognito authorizer allows API Gateway to natively validate the user's ID or access tokens without requiring custom Lambda code, minimizing operational overhead.

Configure secure access to Amazon S3.

Create an Amazon Cognito Identity Pool, specify the User Pool as the authentication provider, and map authenticated users to an IAM role with write permissions to the destination S3 bucket.

Cognito Identity Pools authorize access to AWS resources by exchanging external authentication tokens for scoped, temporary AWS credentials.

Key Concept

Distinction between Amazon Cognito User Pools (authentication) and Cognito Identity Pools (authorization to access AWS resources), alongside native API Gateway Cognito authorizer integration.

Estimated Time:2m 0s

Question 68Question →

A developer is building a serverless web application for a fitness tracking portal. The application must allow users to log in using their existing Google or Facebook accounts. Once authenticated, the application must allow users to retrieve their profile data from an Amazon API Gateway REST API and upload workout videos directly to a private Amazon S3 bucket. Which TWO configuration steps should the developer perform to implement this authentication and authorization workflow with the least operational overhead?

Select all that apply

Configure a Cognito User Pool with Google and Facebook social identity providers, and configure a Cognito Authorizer on the API Gateway REST API.

Configure a Cognito Identity Pool, set the Cognito User Pool as an authentication provider, and assign an authenticated IAM role with write permissions for the S3 bucket.

Configure a Cognito User Pool with Google and Facebook, and associate an IAM role with the User Pool to generate temporary credentials for writing directly to the S3 bucket.

Configure a custom API Gateway Lambda Authorizer to validate the social identity provider tokens, and have it return temporary AWS credentials to the client for the S3 uploads.

Configure a custom API Gateway Lambda Authorizer to validate the Cognito Identity Pool token for the REST API endpoint.

Show answer & explanation

Answer: Configure a Cognito User Pool with Google and Facebook social identity providers, and configure a Cognito Authorizer on the API Gateway REST API.; Configure a Cognito Identity Pool, set the Cognito User Pool as an authentication provider, and assign an authenticated IAM role with write permissions for the S3 bucket.

Answer

Configure a Cognito User Pool with Google and Facebook social identity providers, configure a Cognito Authorizer on the API Gateway REST API, configure a Cognito Identity Pool using the User Pool as an authentication provider, and assign an authenticated IAM role with write permissions for the S3 bucket.

To implement authentication with Google and Facebook and access both API Gateway and S3 with the least operational overhead, the developer should combine a Cognito User Pool with a Cognito Identity Pool. The Cognito User Pool authenticates the federated social users and provides tokens. These tokens are natively validated by the API Gateway Cognito Authorizer to secure REST API endpoints without custom code. To allow direct upload to a private S3 bucket, the application must exchange the User Pool tokens for temporary AWS credentials using a Cognito Identity Pool, which maps the authenticated session to an IAM role with S3 write permissions.

Step-by-Step Solution

Set up User Directory and Social Federation

Configure an Amazon Cognito User Pool with Google and Facebook as identity providers to handle user registration, login, and identity token issuance.

A User Pool acts as the user directory and manages federation, allowing the application to authenticate users and receive JSON Web Tokens (JWTs) representing their identity.

Authorize API Access

Configure a Cognito Authorizer on the Amazon API Gateway REST API endpoints.

The Cognito Authorizer natively validates the identity tokens (JWTs) passed in the authorization header of incoming API requests, securing the backend with zero custom code.

Enable S3 Write Permissions

Create an Amazon Cognito Identity Pool, configure the User Pool as the authentication provider, and associate the authenticated IAM role with S3 write permissions.

An Identity Pool (Federated Identities) is required to exchange the authenticated User Pool token for temporary, short-lived AWS credentials, enabling the client application to directly upload video files to S3 without using a proxy backend.

Key Concept

Amazon Cognito Authentication and Authorization

Question 69Question →

An enterprise web application needs to allow employees to sign in using their corporate Identity Provider (IdP) via SAML 2.0. Once authenticated, the application must allow users to upload files directly to a user-specific folder in an Amazon S3 bucket. The architecture must minimize operational overhead and avoid storing long-term credentials on the client. Which solution meets these requirements with the least operational overhead?

Configure an Amazon Cognito User Pool integrated with the SAML IdP. Retrieve the ID token upon successful authentication and pass it directly to the Amazon S3 API headers to authorize direct client-side uploads.

Configure an Amazon API Gateway endpoint with a custom Lambda Authorizer that validates the SAML assertions, creates a Cognito User Pool user on the fly, and uses the API Gateway service integration to upload files directly to S3.

Configure an Amazon Cognito User Pool integrated with the SAML IdP, and associate it with an Amazon Cognito Identity Pool. Use the Identity Pool to map the federated users to an IAM role that grants access to the user-specific S3 folder using the cognito-identity.amazonaws.com:sub variable.

Configure an Amazon Cognito User Pool integrated with the SAML IdP. Set up an API Gateway endpoint backed by a Lambda function that contains hardcoded IAM access keys to upload files to the S3 bucket on behalf of the user.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool integrated with the SAML IdP, and associate it with an Amazon Cognito Identity Pool. Use the Identity Pool to map the federated users to an IAM role that grants access to the user-specific S3 folder using the cognito-identity.amazonaws.com:sub variable.

Answer

The correct solution leverages Amazon Cognito User Pools to manage authentication with the corporate SAML Identity Provider, and Amazon Cognito Identity Pools to exchange the authentication tokens for temporary AWS IAM credentials. The IAM policy attached to the authenticated role uses the cognito-identity.amazonaws.com:sub policy variable to dynamically restrict access to the user's specific folder in the S3 bucket, ensuring security with minimal operational overhead.

Step-by-Step Solution

Configure SAML federation with the corporate Identity Provider within an Amazon Cognito User Pool.

Users can authenticate against their corporate IdP and receive Cognito User Pool tokens.

This establishes user authentication without managing passwords locally or creating custom SAML validation logic.

Link the Cognito User Pool as an authentication provider in an Amazon Cognito Identity Pool.

The Identity Pool can verify the Cognito User Pool tokens and exchange them for temporary AWS credentials.

Cognito Identity Pools are designed to authorize users and provide temporary AWS IAM credentials.

Create an IAM role for authenticated users with a policy permitting S3 PutObject actions restricted to user-specific prefixes using the cognito-identity.amazonaws.com:sub variable, and associate it with the Identity Pool.

Authenticated users receive dynamic, scope-limited temporary credentials to upload directly to their own S3 folder.

This implements secure, direct client-to-S3 uploads with minimal latency, avoiding the need for an intermediary backend server or hardcoded credentials.

Key Concept

Amazon Cognito Identity Pools are used to federate identities and obtain temporary AWS credentials for accessing AWS resources like Amazon S3, whereas Cognito User Pools handle user directory management and authentication.

Estimated Time:2m 0s

Question 70Question →

A developer is designing a smart-home mobile application that allows authenticated users to read their device telemetry data directly from an Amazon DynamoDB table. The solution must minimize backend server management and allow the mobile app to make direct, secure SDK calls to DynamoDB using temporary AWS credentials, restricting users to only access their own data. Which architecture should the developer implement to meet these requirements?

Configure an Amazon Cognito User Pool for user authentication and directory services, and an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials. Associate an IAM role with the Identity Pool that uses a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID.

Configure an Amazon Cognito User Pool for user authentication. Have the mobile application send the User Pool ID token directly in the authorization header of the AWS SDK client to perform DynamoDB operations.

Configure an Amazon Cognito User Pool for user authentication. Set up Amazon API Gateway with a custom Lambda Authorizer that parses the JWT, validates it against the User Pool, and performs the DynamoDB operations directly within the authorizer function.

Configure an Amazon Cognito Identity Pool as the user directory to manage user sign-ups and logins. Configure the mobile application to use the Identity Pool credentials to access DynamoDB, relying on application-side logic to filter data access.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool for user authentication and directory services, and an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials. Associate an IAM role with the Identity Pool that uses a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID.

Answer

The correct architecture uses Cognito User Pools to authenticate the users, and Cognito Identity Pools to exchange those tokens for temporary AWS credentials. By applying a policy with a dynamodb:LeadingKeys condition matching the Cognito identity ID on the IAM role assumed via the Identity Pool, the developer achieves direct, fine-grained access control to the DynamoDB table with minimal operational overhead.

Step-by-Step Solution

Determine the authentication and directory mechanism.

Implement an Amazon Cognito User Pool to act as the identity provider, managing user registration, sign-in, and authentication tokens.

User Pools are specifically designed for user directories, handling authentication, and generating JSON Web Tokens (JWTs).

Determine the authorization and credential retrieval mechanism.

Implement an Amazon Cognito Identity Pool, configuring the User Pool as an authentication provider.

Identity Pools are designed to exchange authentication tokens (such as User Pool JWTs) for temporary, limited-privilege AWS credentials needed for direct SDK calls.

Apply fine-grained access control in the authorized IAM role.

Attach a policy to the Identity Pool's authenticated IAM role with a dynamodb:LeadingKeys condition set to the user's Cognito identity ID.

Using the dynamodb:LeadingKeys condition ensures that the authenticated user is restricted to reading and writing items in the DynamoDB table where the partition key matches their unique Cognito identity ID.

Key Concept

Integration of Amazon Cognito User Pools and Identity Pools for direct, fine-grained access to AWS services.

Estimated Time:2m 0s

Question 71Question →

A developer is building a serverless web portal for a medical scheduling system. Users must authenticate using their corporate Google Workspace accounts through OpenID Connect (OIDC). Once authenticated, the web portal must invoke private API routes hosted on Amazon API Gateway. The developer needs to validate the user session token at the API Gateway layer with the least operational overhead and without writing custom validation code.

Which solution meets these requirements?

Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.

Configure an Amazon Cognito Identity Pool federated with the Google Workspace OIDC provider, enable AWS IAM authorization on API Gateway, and sign the client API requests using AWS Signature Version 4.

Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and write a custom API Gateway Lambda authorizer to parse and validate the JSON Web Tokens (JWT) manually.

Configure an Amazon Cognito Identity Pool federated with the Google Workspace OIDC provider, and create an API Gateway Cognito authorizer linked to the Identity Pool to validate the client tokens.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.

Answer

Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.

The correct solution uses an Amazon Cognito User Pool to handle the OpenID Connect federation with Google Workspace, which issues standard JSON Web Tokens. By using the built-in API Gateway Cognito authorizer, API Gateway validates these tokens automatically, eliminating the need to write custom validation logic or perform complex request signing on the client.

Step-by-Step Solution

Determine if User Pools or Identity Pools are appropriate for the user federation and token generation requirement.

Amazon Cognito User Pools is chosen to act as the user directory and federated identity consumer for the OIDC provider (Google Workspace).

User Pools are used for authentication and directories, producing JSON Web Tokens (JWTs) such as identity and access tokens.

Select the API Gateway authorizer that validates the authentication tokens with the least operational overhead.

Select the built-in API Gateway Cognito authorizer.

API Gateway's native Cognito authorizer handles JWT validation out of the box, requiring zero custom code and removing the need to manage Lambda functions or sign requests using Signature Version 4.

Key Concept

Selecting the correct Cognito service and API Gateway authorizer type to minimize custom development when integrating external identity providers.

Estimated Time:1m 30s

PreviousPage 4 / 4

Amazon Cognito Authentication and Authorization

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes