A startup is deploying a web portal where authenticated customers can manage their profiles. The application front-end is a React application hosted on Amazon S3. The back-end consists of REST APIs hosted on Amazon API Gateway and powered by AWS Lambda. The developer must implement a secure sign-in mechanism for customers and ensure the REST APIs validate the user's authentication tokens. The solution must minimize custom development effort and optimize runtime efficiency.
Which two configurations should the developer implement to meet these requirements? (Select TWO.)
- Set up an Amazon Cognito User Pool to serve as the user directory and handle user registration and login flows.Cevap
- BSet up an Amazon Cognito Identity Pool to act as the user directory and store user profiles directly.
- Configure a COGNITO_USER_POOLS authorizer on the Amazon API Gateway REST API to automatically validate the client's JSON Web Tokens.Cevap
- DCreate a custom API Gateway Lambda Authorizer to parse, decode, and validate the signature of the client's JWT tokens against the user directory keys.
- EConfigure the API Gateway REST API method authorization to use AWS_IAM and update the Lambda execution role's trust policy to trust Cognito.
Cevap
To implement this architecture, the developer must set up an Amazon Cognito User Pool to act as the user directory and handle sign-in, and configure a native COGNITO_USER_POOLS authorizer on API Gateway to validate the client's JWTs.
Deploying an Amazon Cognito User Pool provides the required user directory, sign-in flow, and JWT token issuance. Combining this with the built-in COGNITO_USER_POOLS authorizer in API Gateway ensures that incoming JWTs are validated automatically without requiring any custom Lambda code, maintaining a cost-effective and low-maintenance configuration.
Adım Adım Çözüm
Anahtar Kavram
Configuring secure authentication and authorization by integrating Amazon Cognito User Pools with API Gateway using the built-in authorizer.
Tahmini Süre:1m 30s