A developer is building a serverless web application where users sign in using their email and password. Once authenticated, the application must allow users to upload files to a private Amazon S3 bucket and make requests to a backend API hosted on Amazon API Gateway. The developer wants to leverage Amazon Cognito for authentication and authorization. Which TWO configuration steps should the developer perform to meet these requirements with the least operational overhead?
- Configure an Amazon Cognito User Pool to handle user registration and sign-in, and use a Cognito authorizer in Amazon API Gateway to authenticate API requests.Cevap
- Configure an Amazon Cognito Identity Pool linked to the User Pool, and map Cognito user groups to IAM roles that grant the required Amazon S3 permissions.Cevap
- CUse the Amazon Cognito User Pool directly to issue temporary AWS credentials for the web application to perform the Amazon S3 upload.
- DCreate a custom API Gateway Lambda authorizer to decode, verify, and validate the JSON Web Tokens (JWTs) sent from the client application.
- EConfigure an Amazon Cognito Identity Pool to store user profiles, manage email verification, and enforce multi-factor authentication (MFA).
Cevap
Configure an Amazon Cognito User Pool to handle user registration and sign-in, use a Cognito authorizer in Amazon API Gateway, and configure an Amazon Cognito Identity Pool linked to the User Pool to map user groups to IAM roles for S3 access.
The correct solution involves using a Cognito User Pool to register and authenticate users, generating JWTs. A Cognito Identity Pool is then linked to the User Pool to exchange these JWTs for temporary AWS IAM credentials, which are mapped to specific roles allowing S3 upload access. Finally, the native Cognito authorizer in API Gateway is configured to validate the User Pool's tokens directly, minimizing operational overhead.
Adım Adım Çözüm
Anahtar Kavram
Amazon Cognito Authentication and Authorization Integration