Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is designing a collaborative document editing web application. The application authenticates users using an Amazon Cognito User Pool. The backend APIs are hosted on Amazon API Gateway. The developer wants to restrict access to a specific API Gateway resource method (POST /documents) so that only users belonging to the 'Editors' Cognito User Pool group can invoke it.

Which TWO configurations would allow the developer to implement this group-based authorization?

  1. Configure the API Gateway resource method to use AWS_IAM authorization. Configure an Amazon Cognito Identity Pool to map Cognito User Pool groups to distinct IAM roles, and configure the application to sign the API requests with the temporary credentials obtained from the Identity Pool.Cevap
  2. Create an API Gateway Lambda Authorizer. Program the Lambda function to validate the User Pool JWT token, extract the cognito:groups claim, and dynamically generate an IAM policy that grants or denies execution permissions for the method based on the group membership.Cevap
  3. C
    Use a built-in API Gateway Cognito User Pool authorizer. Configure the authorizer's OAuth Scopes to point to the 'Editors' group, and map the group name to the API Gateway resource path.
  4. D
    Set up an API Gateway Cognito User Pool authorizer. Configure the backend integration to inspect the incoming ID token, and have the backend Lambda function call the Cognito AdminGetUser API to verify the user's group membership before executing the request.
  5. E
    Configure the Cognito User Pool with a pre-token generation Lambda trigger. Modify the trigger to issue temporary AWS credentials with an attached IAM policy that limits access to the API Gateway resource, and pass these credentials in the authorization header.

Cevap

The developer can implement group-based authorization by configuring the API Gateway method to use AWS_IAM authorization combined with a Cognito Identity Pool mapping groups to IAM roles, or by implementing an API Gateway Lambda Authorizer that inspects the cognito:groups claim inside the JWT token to generate a dynamic IAM policy.
Group-based authorization in Amazon API Gateway cannot be natively enforced using only the built-in Cognito User Pool authorizer. To restrict resource access to specific Cognito groups, two approaches are valid. The first is to set up a Cognito Identity Pool that maps User Pool groups to distinct IAM roles, secure the API Gateway methods with AWS_IAM, and have the client sign requests using temporary credentials. The second is to implement an API Gateway Lambda Authorizer. This custom authorizer validates the token, extracts the group claims from the token's claims, and outputs an IAM policy that allows or denies the execution of the requested method.

Adım Adım Çözüm

1
Determine where the authorization check should occur.
Authorization should occur at the API Gateway layer before invoking backend resources to avoid unnecessary invocation costs and latency.
This rules out executing database checks or calling identity administration APIs inside the backend integration.
2
Evaluate Cognito Identity Pools role-mapping.
Cognito Identity Pools allow mapping Cognito User Pool groups directly to IAM roles. These roles contain policies that permit or deny actions on API Gateway resource methods (execute-api:Invoke).
The client uses these mapped roles to obtain temporary AWS credentials and signs the HTTP request to API Gateway.
3
Evaluate custom Lambda Authorizers.
A Lambda Authorizer intercepts API requests, decodes the JWT token sent by the client, reads the groups from the token payload, and constructs a standard IAM policy dynamically.
This provides fine-grained control directly in code without requiring clients to obtain temporary AWS credentials.

Anahtar Kavram

Amazon Cognito Group-Based API Authorization
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru