Examkin

Soru

Zorluk: OrtaApplication Authentication and Authorization with Amazon Cognito

A developer is designing the authentication and authorization architecture for a new serverless web application. The frontend of the application is a Single-Page Application (SPA) that will interact with backend services exposed via an Amazon API Gateway HTTP API. The developer needs to authenticate users using an Amazon Cognito User Pool and ensure that only authenticated users can access the HTTP API routes. The solution must minimize both custom code development and execution cost.

Which combination of steps should the developer perform to meet these requirements? (Select TWO.)

  1. Configure a JWT authorizer in the API Gateway HTTP API, specifying the Cognito User Pool's Issuer URL as the identity source and the app client ID as the audience.Cevap
  2. Configure the frontend application to include the ID token or access token in the Authorization header of HTTP requests sent to the API Gateway.Cevap
  3. C
    Configure an Amazon Cognito Identity Pool to exchange User Pool tokens for temporary IAM credentials, and configure API Gateway to use AWS_IAM authorization.
  4. D
    Create a custom AWS Lambda authorizer that validates and decodes the JSON Web Tokens (JWT) issued by the Cognito User Pool.
  5. E
    Establish an IAM trust policy that allows the Cognito User Pool to assume an IAM role with permission to invoke the API Gateway HTTP API.

Cevap

Configure a JWT authorizer in the API Gateway HTTP API, specifying the Cognito User Pool's Issuer URL as the identity source and the app client ID as the audience, and configure the frontend application to include the ID token or access token in the Authorization header of HTTP requests sent to the API Gateway.
To secure an API Gateway HTTP API with Amazon Cognito User Pools while minimizing custom code and costs, a developer should utilize the native JWT authorizer. The JWT authorizer validates tokens issued by Cognito User Pools automatically by checking their signature, issuer, and audience claims. The frontend application must retrieve this token upon user sign-in and include it in the Authorization header of all API calls so the gateway can inspect and authorize the requests.

Adım Adım Çözüm

1
Identify the built-in authorization options for API Gateway HTTP APIs.
Determine that native JWT Authorizers can validate Cognito User Pool tokens directly without writing custom code or incurring execution fees.
This meets the requirement of minimizing both custom development effort and execution costs.
2
Configure the JWT authorizer parameters in API Gateway.
Point the authorizer to the Cognito User Pool's Issuer URL as the identity source and set the app client ID as the audience parameter.
This allows API Gateway to verify that the token was signed by the correct User Pool and generated for the correct application client.
3
Pass the JWT from the frontend application.
Update the frontend application logic to attach the ID or access token in the Authorization header of API requests.
This ensures that API Gateway receives the token in the expected request location to perform authorization checks.

Anahtar Kavram

JWT authorizer integration with Amazon Cognito User Pools for API Gateway HTTP APIs
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Application Authentication and Authorization with Amazon Cognito

Bu konudan daha fazla soru