Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A company is building a machine-to-machine (M2M) integration that allows an on-premises backend service to programmatically upload raw telemetry data to a private Amazon API Gateway endpoint. The developer needs to secure the API Gateway endpoint using Amazon Cognito. The backend service must authenticate using its credentials, obtain an access token, and use this token to authorize its API requests.

Which solution meets these requirements with the least operational overhead?

  1. Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, configure a Cognito User Pool authorizer and set the OAuth scopes on the API method.Cevap
  2. B
    Configure an Amazon Cognito Identity Pool to federate the on-premises backend service. Use the developer-authenticated identities feature to generate temporary AWS credentials, and configure IAM authorization on the API Gateway endpoint.
  3. C
    Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, write a custom Lambda authorizer to decode, verify, and validate the signature of the Cognito JWT access token.
  4. D
    Configure an Amazon Cognito User Pool and create a user account for the on-premises service. Use the USER_PASSWORD_AUTH authentication flow to retrieve an ID token, and use an API Gateway Cognito User Pool authorizer to secure the method.

Cevap

Configure an Amazon Cognito User Pool with a resource server and a user pool client configured with the client credentials grant. In Amazon API Gateway, configure a Cognito User Pool authorizer and set the OAuth scopes on the API method.
The correct solution uses an Amazon Cognito User Pool with the client credentials grant to support machine-to-machine authentication. By defining a resource server with custom scopes, the backend service can retrieve a JWT access token. Securing the API Gateway is natively achieved by configuring a built-in Cognito User Pool authorizer and applying the custom OAuth scopes to the API method, which eliminates the need to write custom Lambda code or manage complex developer-authenticated identity flows.

Adım Adım Çözüm

1
Set up a Cognito User Pool with a client credentials flow
Created a User Pool, defined a resource server with custom scopes, and enabled the client credentials grant on the app client.
This allows the on-premises machine/service to authenticate programmatically using its client ID and client secret, receiving a standard OAuth 2.0 JSON Web Token (JWT) access token containing the scopes.
2
Configure API Gateway Authorization
Created an API Gateway Cognito User Pool authorizer and associated it with the target API resource methods, specifying the custom OAuth scopes required to invoke them.
This offloads token validation to API Gateway's native authorizer, ensuring that only requests with a valid token containing the correct scopes are allowed to pass through to the backend.

Anahtar Kavram

Using Amazon Cognito User Pools for OAuth 2.0 client credentials grant and securing API Gateway with a built-in Cognito authorizer.
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru