A developer is building a multi-tenant web application where users authenticate using an Amazon Cognito User Pool. The application must allow authenticated users to perform the following tasks:
* Call a private backend REST API deployed on Amazon API Gateway.
* Directly query tenant-specific items in an Amazon DynamoDB table using temporary AWS credentials.
The user's tenant ID is stored as a custom attribute (`custom:tenant_id`) in the Cognito User Pool. The developer wants to implement a secure, low-overhead solution that minimizes the number of IAM roles and avoids custom Lambda authorizers or validation code.
Which TWO configurations should the developer implement to meet these requirements?
- Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API, and set the API methods to require this authorizer, validating the tokens passed in the request header.Cevap
- Create an Amazon Cognito Identity Pool, link it to the User Pool, and enable the 'Attributes for access control' feature mapping the `custom:tenant_id` claim to a principal tag. Reference `${aws:PrincipalTag/tenant_id}` in the IAM policy condition for the authenticated role.Cevap
- CConfigure a custom Lambda authorizer on the API Gateway REST API to decode the Cognito User Pool token, call `sts:AssumeRole` to retrieve temporary credentials, and pass them back to the client.
- DConfigure the Amazon Cognito User Pool to directly issue temporary AWS credentials to the client application, and use a policy condition matching `cognito-idp:tenant_id` to restrict DynamoDB queries.
- EModify the trust policy of the authenticated IAM role to allow the API Gateway service principal (`apigateway.amazonaws.com`) to assume the role using the `sts:AssumeRole` action on behalf of the client.
Cevap
Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API to validate tokens, and create an Amazon Cognito Identity Pool linked to the User Pool that maps the custom tenant ID claim to a principal tag using attributes for access control.
To secure the REST API with minimum overhead, using a built-in Cognito User Pool authorizer is the best option because API Gateway handles the token validation natively. To query DynamoDB directly from the client with temporary AWS credentials, the application must use a Cognito Identity Pool linked to the User Pool. To enforce tenant isolation with low overhead (minimizing IAM roles), the developer should configure 'Attributes for access control' in the Identity Pool. This maps the custom user attribute (`custom:tenant_id`) to a principal tag, allowing the IAM policy for the authenticated role to dynamically restrict access using `${aws:PrincipalTag/tenant_id}`.
Adım Adım Çözüm
Anahtar Kavram
Integration of Amazon Cognito User Pools and Identity Pools for unified authentication (API Gateway) and fine-grained authorization (temporary credentials for DynamoDB via ABAC).