Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is implementing a desktop gaming client that needs to authenticate users and allow them to upload gameplay screenshots directly to a private Amazon S3 bucket. The application must also communicate with a backend API hosted on Amazon API Gateway, where endpoints should only be accessible to authenticated users.

Which TWO actions must the developer take to implement this authentication and authorization design? (Select TWO.)

  1. Configure an Amazon Cognito User Pool to handle user registration and authentication, and use the Cognito Authorizer on the API Gateway endpoints.Cevap
  2. Configure an Amazon Cognito Identity Pool using the User Pool as an identity provider to obtain temporary AWS credentials for S3 uploads.Cevap
  3. C
    Configure the Amazon Cognito User Pool to generate temporary AWS credentials with an attached IAM policy for the S3 bucket.
  4. D
    Deploy a custom Lambda Authorizer in API Gateway to decrypt, verify, and validate the signature of the User Pool tokens for basic endpoint security.
  5. E
    Hardcode a set of long-term IAM access keys within the desktop client to sign the S3 upload requests.

Cevap

To implement this architecture, configure an Amazon Cognito User Pool to handle user registration and authentication, and use the Cognito Authorizer on the API Gateway endpoints. Additionally, configure an Amazon Cognito Identity Pool using the User Pool as an identity provider to obtain temporary AWS credentials for S3 uploads.
To secure the backend API endpoints, the developer should configure an Amazon Cognito User Pool for user authentication and use the built-in API Gateway Cognito Authorizer, which natively validates JWTs without custom backend code. To enable direct uploads to Amazon S3 without exposing long-term credentials, the developer must configure an Amazon Cognito Identity Pool using the User Pool as an identity provider, which issues temporary AWS credentials with appropriate IAM permissions.

Adım Adım Çözüm

1
Set up a Cognito User Pool to manage authentication.
Users can sign up, log in, and receive standard JSON Web Tokens (JWTs) representing their identity.
A User Pool acts as the primary identity provider for the application.
2
Integrate the User Pool with API Gateway.
API Gateway uses the Cognito User Pool Authorizer to inspect the Authorization header and validate the JWTs.
This secures the API endpoints with minimal operational overhead and zero custom code.
3
Set up a Cognito Identity Pool and link it to the User Pool.
The desktop client can exchange User Pool JWTs for temporary, short-lived AWS credentials via IAM roles defined in the Identity Pool.
This allows the client application to upload files directly to S3 securely without hardcoding long-term credentials.

Anahtar Kavram

Integration of Amazon Cognito User Pools for authentication and Identity Pools (Federated Identities) for authorizing access to AWS resources like S3.
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru