Examkin

Soru

Zorluk: OrtaApplication Authentication and Authorization with Amazon Cognito

An organization is building a new client-side dashboard application. Users must be able to sign up and log in using their corporate email addresses. Once logged in, the dashboard must call a protected REST API hosted on Amazon API Gateway and also fetch user-specific reports directly from a private Amazon S3 bucket. Which architecture should the developer implement to provide secure authentication for the REST API and direct authorization for the S3 bucket with the least operational overhead?

  1. Use an Amazon Cognito User Pool to authenticate users and pass the OIDC ID token to the API Gateway Cognito Authorizer, and use an Amazon Cognito Identity Pool to exchange the ID token for temporary IAM credentials that grant access to the S3 bucket.Cevap
  2. B
    Use an Amazon Cognito User Pool to manage user authentication, and configure the User Pool app client to directly return temporary IAM credentials to the client application for S3 bucket access.
  3. C
    Use an Amazon Cognito User Pool to authenticate users, configure a custom Lambda authorizer on API Gateway to validate the ID token, and use Cognito User Pool groups to authorize direct S3 bucket downloads.
  4. D
    Use an Amazon Cognito User Pool to authenticate users, and configure an IAM role with a trust policy that permits the Amazon S3 service to assume the role directly on behalf of the authenticated client.

Cevap

Use an Amazon Cognito User Pool to authenticate users and pass the OIDC ID token to the API Gateway Cognito Authorizer, and use an Amazon Cognito Identity Pool to exchange the ID token for temporary IAM credentials that grant access to the S3 bucket.
The correct architecture uses an Amazon Cognito User Pool for user authentication and directory services. The OIDC ID token returned by the User Pool is verified directly by API Gateway using the built-in Cognito Authorizer. To access private S3 resources directly from the client, the application uses an Amazon Cognito Identity Pool to exchange the ID token for temporary AWS IAM credentials, which are authorized by an IAM policy attached to the authenticated role.

Adım Adım Çözüm

1
Configure an Amazon Cognito User Pool to act as the user directory and handle sign-up and sign-in, returning OIDC tokens (ID token and Access token) upon successful authentication.
Users can authenticate and obtain an ID token containing identity claims.
Cognito User Pools provide authentication and user directory management.
2
Create an API Gateway Cognito Authorizer and associate it with the REST API resources, configuring the client to pass the ID token in the authorization header.
API Gateway automatically validates the ID token against the Cognito User Pool client.
This provides built-in token validation without writing custom Lambda code.
3
Configure an Amazon Cognito Identity Pool that lists the User Pool as an authentication provider, and associate an authenticated IAM role with the Identity Pool.
The client application can exchange the User Pool ID token for temporary AWS IAM credentials.
Cognito Identity Pools provide authorization to access AWS resources directly like S3.

Anahtar Kavram

Cognito User Pools authenticate users and issue tokens, while Cognito Identity Pools authorize users by exchanging those tokens for temporary AWS credentials.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Application Authentication and Authorization with Amazon Cognito

Bu konudan daha fazla soru