Examkin

Soru

Zorluk: OrtaApplication Authentication and Authorization with Amazon Cognito

A developer is building a serverless web application with a single-page application (SPA) frontend. The frontend needs to access a REST API hosted on Amazon API Gateway. The developer wants to implement user registration and sign-in, and must secure the REST API so that only authenticated users can access the endpoints. To minimize latency and eliminate the operational overhead of writing custom token validation code, which solution should the developer implement?

  1. A
    Configure an Amazon Cognito Identity Pool to authenticate users. Create an Amazon API Gateway Lambda authorizer that exchanges the user credentials for temporary AWS credentials using the Cognito API on each API call.
  2. B
    Configure an Amazon Cognito Identity Pool to authenticate users. Enable IAM authorization on the Amazon API Gateway endpoints, and configure a trust policy on the API Gateway execution role to allow it to assume the authenticated IAM role of the identity pool.
  3. Configure an Amazon Cognito User Pool to manage user sign-up and sign-in. On the Amazon API Gateway REST API, create a Cognito user pool authorizer to automatically validate the identity or access tokens passed in the request header.Cevap
  4. D
    Configure an Amazon Cognito User Pool to manage user sign-up and sign-in. Create a custom Amazon API Gateway Lambda authorizer that downloads the JSON Web Key Set (JWKS) from the Cognito User Pool to manually verify the signature of the incoming tokens.

Cevap

Configure an Amazon Cognito User Pool to manage user sign-up and sign-in, and use a built-in API Gateway Cognito user pool authorizer to validate the tokens.
The correct solution involves using a Cognito User Pool to manage user authentication and the built-in API Gateway Cognito authorizer to validate JWT tokens. This satisfies the requirement of minimizing development overhead and latency, as it avoids writing and maintaining a custom Lambda function for token signature validation.

Adım Adım Çözüm

1
Identify the service needed for user authentication directory management.
Amazon Cognito User Pools is selected because it manages user directories, registration, and authentication.
Cognito Identity Pools are for authorization and temporary AWS credential vending, not user registration.
2
Determine the token verification method for API Gateway that minimizes latency and operational overhead.
The built-in API Gateway Cognito user pool authorizer is selected.
It natively validates the signature and expiration of Cognito User Pool tokens without executing custom Lambda code.

Anahtar Kavram

Using Cognito User Pools with built-in API Gateway authorizers for serverless authentication
Bu soruyu puanla

Konular

Application Authentication and Authorization with Amazon Cognito

Bu konudan daha fazla soru