Examkin

Soru

Zorluk: ZorAmazon Cognito Authentication and Authorization

An enterprise web application requires users to sign in using their corporate Identity Provider (IdP) via SAML 2.0. After successful authentication, the web application must access tenant-specific folders in an Amazon S3 bucket directly from the browser. Additionally, the application must make authorized calls to a backend REST API hosted on Amazon API Gateway. The developer wants to minimize custom coding for token validation and credential exchange. Which architecture configuration satisfies these requirements with the least operational overhead?

  1. A
    Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs. Secure the REST API using an API Gateway Cognito Authorizer. Authorize direct S3 access by passing the Cognito User Pool ID token in the Authorization header of the S3 request.
  2. B
    Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs. Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider to obtain temporary IAM credentials for S3 access. Secure the REST API using an API Gateway Lambda authorizer that performs custom validation of the Cognito User Pool ID token.
  3. Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs. Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider to obtain temporary IAM credentials for S3 access. Secure the REST API using an API Gateway Cognito Authorizer that validates the User Pool tokens.Cevap
  4. D
    Configure an Amazon Cognito Identity Pool with the SAML IdP configured as an identity provider to authenticate users and obtain temporary IAM credentials for S3 access. Secure the REST API using an API Gateway Cognito Authorizer that directly validates the temporary IAM credentials.

Cevap

Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs, use an Amazon Cognito Identity Pool to obtain temporary IAM credentials for S3 access, and secure the REST API using an API Gateway Cognito Authorizer that validates User Pool tokens.
The correct option correctly uses Cognito User Pools to handle federation and authentication via SAML 2.0, Cognito Identity Pools to exchange user identity for temporary IAM credentials for S3 access, and the native API Gateway Cognito Authorizer to secure backend API requests. This aligns perfectly with the responsibilities of each Cognito component and achieves the requirements with the least operational and development overhead.

Adım Adım Çözüm

1
Configure SAML federation in Cognito User Pool
Users can authenticate against the corporate IdP via SAML 2.0, and Cognito User Pool issues ID, access, and refresh tokens.
This establishes user identity and directory management using the existing corporate IdP.
2
Integrate Cognito Identity Pool with the User Pool
The application can exchange the Cognito User Pool ID token for temporary AWS IAM credentials.
This enables secure, direct access to S3 without exposing static AWS credentials or routing S3 uploads through a backend proxy.
3
Configure API Gateway with a Cognito User Pool Authorizer
API Gateway automatically validates incoming Cognito User Pool tokens to authorize REST API requests.
This secures the REST API using built-in platform capabilities, avoiding the overhead of custom Lambda validation code.

Anahtar Kavram

Integration of Cognito User Pools (authentication & token issuance), Cognito Identity Pools (temporary AWS credentials for direct resource access), and API Gateway Cognito Authorizers (token-based API security).
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru