Examkin

Soru

Zorluk: ZorApplication Authentication and Authorization with Amazon Cognito

A company needs to integrate an on-premises backend daemon service with a REST API hosted on AWS behind Amazon API Gateway. The daemon service must perform automated, non-interactive batch uploads to the API. Security requirements state that authentication must be handled via Amazon Cognito, leveraging OAuth 2.0 flows, and the service must be granted only the specific scope required for writing data (api/write). How should the developer configure Cognito and the daemon service to implement this authentication flow?

  1. A
    Create a Cognito Identity Pool that permits unauthenticated access. Have the daemon service exchange its client credentials for temporary AWS credentials using the Cognito Identity Pool API, and sign the HTTP requests to API Gateway using AWS Signature Version 4.
  2. B
    Configure a Cognito User Pool App Client with the Authorization Code grant. Implement a custom Lambda Authorizer on the API Gateway REST API to perform the OAuth 2.0 token exchange with Cognito, validate the returned ID token, and cache the authorization decision.
  3. Configure a Cognito User Pool with an App Client that has a client secret, enabling the Client Credentials grant flow and defining a custom scope of 'api/write'. Have the daemon service request an access token from the Cognito token endpoint, and use a Cognito User Pool authorizer on API Gateway to validate the token.Cevap
  4. D
    Configure an IAM Role with a trust policy that allows the Cognito User Pool to assume the role. Instruct the daemon service to call the Cognito authentication endpoint to assume this IAM Role, and then use the returned temporary credentials to sign requests to API Gateway.

Cevap

Configure a Cognito User Pool with an App Client that has a client secret, enabling the Client Credentials grant flow and defining a custom scope of 'api/write'. Have the daemon service request an access token from the Cognito token endpoint, and use a Cognito User Pool authorizer on API Gateway to validate the token.
The Client Credentials grant flow is the standard OAuth 2.0 flow for machine-to-machine (M2M) or server-to-server authentication where no interactive user is present. By configuring a Cognito User Pool App Client with a client secret, enabling the Client Credentials flow, and defining custom resource scopes (like 'api/write'), the backend daemon service can securely request a JWT access token directly from the Cognito OAuth 2.0 token endpoint. API Gateway can then validate this access token natively using a Cognito User Pool Authorizer without requiring custom code.

Adım Adım Çözüm

1
Create a Cognito User Pool and configure a Resource Server with the custom scope 'api/write'.
A user pool capable of scoping API access permissions for machine clients.
To define the access permissions required by the daemon service as an OAuth 2.0 scope.
2
Create an App Client within the User Pool, generate a client secret, and enable the 'Client Credentials' OAuth 2.0 grant.
An App Client with credentials suitable for non-interactive backend authentication.
To allow the daemon service to authenticate using its client ID and client secret directly.
3
Configure the API Gateway REST API with a Cognito User Pool Authorizer pointing to the created User Pool, and specify the required OAuth scope.
API Gateway will validate incoming access tokens and verify they contain the 'api/write' scope.
To secure the API endpoints and ensure only authorized clients can access the writing operations.
4
Program the daemon service to send a POST request to the Cognito domain's token endpoint (/oauth2/token) with its credentials, then attach the returned access token as a Bearer token in the API request headers.
The daemon service successfully authenticates and authorizes its requests to API Gateway.
To implement the standard client request and authentication flow for the daemon service.

Anahtar Kavram

Implementing machine-to-machine authentication using the Cognito User Pool Client Credentials grant flow and validating access tokens using an API Gateway Cognito User Pool Authorizer.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Application Authentication and Authorization with Amazon Cognito

Bu konudan daha fazla soru