Examkin

Soru

Zorluk: ZorAmazon Cognito Authentication and Authorization

An enterprise web application requires federated authentication via an external SAML 2.0 Identity Provider (IdP). Once authenticated, users must be able to download files directly from an Amazon S3 bucket. Access must be restricted such that users can only download objects from an S3 prefix that matches their department name (e.g., `company-data/hr/*` for the 'hr' department). The department name is supplied as a custom SAML assertion claim named `department`.

Which configuration should the developer implement to meet these requirements with the least administrative and coding overhead?

  1. Configure an Amazon Cognito Identity Pool with the SAML IdP. Set up Attribute Mapping to map the SAML `department` claim to the principal tag `department`. In the IAM policy attached to the authenticated role, grant `s3:GetObject` permission for the resource `arn:aws:s3:::company-data/${aws:PrincipalTag/department}/*`.Cevap
  2. B
    Configure an Amazon Cognito User Pool with the SAML IdP. Create a Post Authentication AWS Lambda trigger that checks the user's `department` attribute, generates temporary AWS credentials with a dynamic policy, and stores them in the User Pool's custom user attributes for the client to retrieve.
  3. C
    Configure an Amazon API Gateway endpoint with a custom Lambda Authorizer. Send the SAML assertion to API Gateway, and have the Lambda Authorizer validate it, perform an AWS STS `AssumeRole` call to get temporary credentials for the specific department prefix, and return the credentials inside the authorizer's output context.
  4. D
    Configure an Amazon Cognito Identity Pool with the SAML IdP. Create separate IAM roles for each department with corresponding S3 bucket policies. Use a custom Lambda function to update the Identity Pool's role mapping rules daily to map each user's email address to their specific department's IAM role.

Cevap

Configure an Amazon Cognito Identity Pool with the SAML IdP, map the SAML attribute to the principal tag, and reference the tag in the IAM policy using a policy variable.
The correct option maps the SAML assertion claim to a principal tag in the Cognito Identity Pool configuration. This allows the IAM role to use Attribute-Based Access Control (ABAC) and dynamic policy variables (`${aws:PrincipalTag/department}`) to restrict access to department-specific prefixes in S3 with a single IAM role, minimizing overhead.

Adım Adım Çözüm

1
Configure the Identity Pool with the SAML Identity Provider.
This enables federation, allowing Cognito to accept SAML assertions from the external IdP.
Cognito Identity Pools broker access to AWS resources by exchanging external identity tokens for temporary AWS credentials.
2
Set up Attribute Mapping in the Identity Pool.
The `department` claim from the SAML assertion is mapped to the principal tag `department` in the AWS security token context.
This enables Attribute-Based Access Control (ABAC) by attaching the department tag to the assumed IAM role session.
3
Reference the principal tag in the IAM role's permission policy.
A dynamic resource ARN `arn:aws:s3:::company-data/${aws:PrincipalTag/department}/*` is used in the policy.
This allows a single IAM role to scale across multiple departments without requiring manual configuration changes or multiple roles.

Anahtar Kavram

Attribute-Based Access Control (ABAC) with Amazon Cognito Identity Pools and SAML federation
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru