Examkin

Soru

Zorluk: Çok zorAmazon Cognito Authentication and Authorization

A developer is building a mobile application that allows external users to authenticate using an external OpenID Connect (OIDC) identity provider. Once authenticated, users must be able to upload log files directly to a private Amazon S3 bucket. Each user's uploads must be restricted to an S3 folder named after their unique OIDC user identifier (the `sub` claim). The application also needs to write metadata for each upload to an Amazon DynamoDB table, using the same OIDC `sub` value as the partition key. Which solution meets these requirements with the least development effort and adheres to the principle of least privilege?

  1. A
    Configure an Amazon Cognito User Pool with the OIDC provider. Configure an Amazon Cognito Identity Pool using the User Pool as an authentication provider. In the authenticated IAM role, define the S3 prefix and DynamoDB partition key using the policy variable `${cognito-identity.amazonaws.com:sub}`.
  2. B
    Create an Amazon API Gateway endpoint with a custom Lambda Authorizer. Have the Lambda Authorizer validate the OIDC token, retrieve the `sub` claim, and call `sts:AssumeRole` to generate temporary AWS credentials with an inline IAM policy scoped to the user's OIDC `sub` prefix. Pass these credentials back to the client to perform S3 and DynamoDB operations.
  3. Configure an Amazon Cognito User Pool with the OIDC provider as an identity provider, mapping the OIDC `sub` claim to a custom attribute. Configure an Amazon Cognito Identity Pool with the User Pool as an authentication provider, enabling 'Attributes for access control' to map the custom attribute to a principal tag. Reference the mapped tag using `${aws:PrincipalTag/...}` in the IAM policy for the authenticated role to authorize S3 and DynamoDB actions.Cevap
  4. D
    Federate the OIDC provider directly with an Amazon Cognito Identity Pool. Associate an IAM role with the Identity Pool, and reference `${amazon.cognito.auth.externalIdp:sub}` in the IAM policy to restrict S3 bucket and DynamoDB access.

Cevap

The correct solution is to configure the Amazon Cognito User Pool to map the OIDC `sub` claim to a custom attribute, map that attribute to a principal tag in the Identity Pool using 'Attributes for access control', and reference the tag via the policy variable in the IAM policy.
Mapping the OIDC `sub` claim to a Cognito User Pool custom attribute, exposing it as a Principal Tag via the Identity Pool's 'Attributes for access control', and utilizing the principal tag policy variable in the IAM policy is the most secure and operationally efficient way to implement attribute-based access control (ABAC) for federated users.

Adım Adım Çözüm

1
Map the OIDC provider's unique `sub` claim to a custom attribute (e.g., `custom:oidc_sub`) in the Amazon Cognito User Pool during authentication setup.
The external provider's unique user identifier is captured and persisted in the Cognito user directory.
This makes the claim available for downstream mapping within AWS credentials session generation.
2
Enable 'Attributes for access control' in the Amazon Cognito Identity Pool and configure a mapping from the custom User Pool attribute `custom:oidc_sub` to a principal tag (e.g., `user_id`).
The identity provider claim is converted into a session tag (`aws:PrincipalTag/user_id`) attached to the temporary credentials issued by AWS STS.
This enables Attribute-Based Access Control (ABAC) dynamically on AWS services using IAM policy variables.
3
Create an IAM policy for the Cognito authenticated role that restricts S3 access to `arn:aws:s3:::my-bucket/aws:PrincipalTag/userid/∗‘andDynamoDBaccessbasedontheleadingkeymatching‘{aws:PrincipalTag/user_id}/*` and DynamoDB access based on the leading key matching `{aws:PrincipalTag/user_id}`.
Dynamic, fine-grained access control is enforced automatically for each unique user based on their federated OIDC session identifier.
This adheres to the principle of least privilege without creating separate IAM roles per user or writing token exchange logic.

Anahtar Kavram

Attribute-Based Access Control (ABAC) with Amazon Cognito Identity Pools and federated OIDC providers.
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru