Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM)

A company is developing a new mobile application that allows users to upload profile pictures directly to an Amazon S3 bucket. The application developers need to establish a mechanism to authenticate users and authorize S3 write access without embedding long-term credentials in the mobile application package. Which solution meets these security requirements with the least administrative overhead?

  1. Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.Answer
  2. B
    Generate AWS Account Root User access keys and embed them in the mobile application configuration file to sign all S3 API requests.
  3. C
    Create a dedicated IAM user for each mobile application user, generate long-term access keys, and distribute them to the mobile devices during registration.
  4. D
    Store a single administrative IAM user's credentials in AWS Systems Manager Parameter Store as a plaintext String parameter and configure the mobile app to fetch it via a public API.

Answer

Configure Amazon Cognito Identity Pools to authenticate users through public identity providers and exchange the identity tokens for temporary AWS credentials using an IAM role.
The correct solution uses Amazon Cognito Identity Pools to exchange tokens from public identity providers for temporary, scoped AWS credentials. This approach allows the mobile application to upload profile pictures directly to S3 by assuming an IAM role with limited permissions, eliminating the need to distribute or store long-term keys on the devices.

Step-by-Step Solution

1
Analyze the requirements for external mobile application users requesting write access to Amazon S3.
Identify that the solution must avoid using long-term credentials, scale dynamically for external users, and run with the least administrative overhead.
Storing static IAM credentials on untrusted client devices violates the principle of least privilege and introduces security risks.
2
Evaluate identity federation mechanisms to delegate access to AWS resources.
Determine that Amazon Cognito Identity Pools (Federated Identities) is the native AWS service built to authenticate external users and issue temporary AWS Security Token Service (STS) credentials.
This allows the application to assume a specific IAM role containing a policy that grants permission only to write to the S3 bucket.

Key Concept

Temporary Security Credentials and Mobile Client Identity Federation
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic