Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is building a web application where users must register and log in to access the system. The application needs to retrieve files from a private Amazon S3 bucket directly from the client browser and invoke private REST APIs hosted on Amazon API Gateway. Which Amazon Cognito configuration will meet these requirements with the least operational overhead?

  1. A
    Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and write a custom API Gateway Lambda Authorizer to manually decode and validate the User Pool JSON Web Tokens (JWTs) to secure the REST APIs.
  2. B
    Use a Cognito Identity Pool to manage user sign-ups, logins, and client federation. Use a Cognito User Pool to generate the temporary AWS credentials required for direct Amazon S3 bucket access, and configure an API Gateway Cognito User Pool Authorizer targeting the Identity Pool to secure the REST APIs.
  3. Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.Cevap
  4. D
    Use a Cognito User Pool to manage user sign-ups and logins, and attach an IAM policy directly to User Pool groups to authorize direct Amazon S3 bucket access. Configure an API Gateway Cognito User Pool Authorizer pointing to the groups to secure the REST APIs.

Cevap

Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.
The correct option correctly identifies the separation of concerns: using a Cognito User Pool for user authentication, a Cognito Identity Pool to authorize direct AWS resource access (S3) via temporary credentials, and a built-in Cognito User Pool authorizer to protect the API Gateway endpoints. This represents the most operationally efficient architecture.

Adım Adım Çözüm

1
Identify the authentication directory requirements.
Determine that user registration, sign-in, and profile directory management should be handled by an Amazon Cognito User Pool.
User Pools provide authentication, registration, and directory features for client applications.
2
Establish a secure mechanism for direct browser-to-S3 access.
Implement an Amazon Cognito Identity Pool configured with the User Pool as an identity provider to vend temporary, limited-privilege AWS credentials via IAM roles.
Identity Pools authorize users to access AWS resources (like S3) directly without exposing long-term credentials or routing requests through an intermediate backend.
3
Select the most efficient API Gateway authorizer.
Configure a native API Gateway Cognito User Pool Authorizer to secure the REST API endpoints using the tokens issued by the User Pool.
The built-in Cognito authorizer validates JWTs natively, eliminating the need to write, test, and pay for a custom Lambda authorizer function.

Anahtar Kavram

Amazon Cognito User Pools vs. Identity Pools, and API Gateway integration.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru