Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is building a multi-tenant SaaS administration portal. The portal must allow enterprise users to authenticate via their corporate SAML Identity Provider (IdP). Once authenticated, the portal needs to make authorized REST API calls to Amazon API Gateway, where access is controlled based on the user's groups. Additionally, the portal must allow the client application to directly upload diagnostic log files to a tenant-specific folder in a private Amazon S3 bucket.

Which TWO actions should the developer take to implement authentication and authorization for this portal?

  1. Create an Amazon Cognito User Pool integrated with the SAML IdP to manage user authentication, and configure an Amazon API Gateway Cognito authorizer to secure the REST API using the ID token.Cevap
  2. Create an Amazon Cognito Identity Pool associated with the User Pool, and map the authenticated user identity to an IAM role that grants write permissions to the tenant-specific S3 folder.Cevap
  3. C
    Create an API Gateway Lambda authorizer to validate the SAML assertion directly from the client, and use the Lambda function to generate an IAM policy that grants direct write permissions to the S3 bucket.
  4. D
    Configure the Amazon Cognito User Pool to issue OAuth 2.0 access tokens, and configure the S3 bucket policy to authorize write requests by verifying these access tokens directly.
  5. E
    Embed the access keys of an IAM user in the client-side portal configuration, and use the AWS SDK to call the AWS Security Token Service (AWS STS) AssumeRole API for S3 access.

Cevap

To implement authentication and authorization, the developer must create a User Pool integrated with the SAML IdP and use an API Gateway Cognito authorizer, while also using an Identity Pool to obtain temporary credentials for S3 uploads.
The correct architecture uses a Cognito User Pool for federating with the SAML IdP and managing user login. The ID tokens issued by the User Pool are verified by the API Gateway Cognito authorizer to protect the API. The Identity Pool then exchanges the User Pool tokens for temporary, scoped IAM credentials, enabling the client application to directly upload logs to Amazon S3 securely.

Adım Adım Çözüm

1
Configure the authentication layer by creating an Amazon Cognito User Pool.
Allows integration with the external corporate SAML Identity Provider (IdP) to authenticate users and generate standard OIDC tokens (ID and access tokens).
This establishes the identity directory and federates corporate authentication.
2
Secure the Amazon API Gateway REST API endpoints using the Cognito User Pool.
Configuring a Cognito authorizer on the REST API resources validates the ID token passed in the Authorization header.
This enforces API authorization based on Cognito groups and claims without custom Lambda code.
3
Set up the authorization layer for external AWS resources by creating an Amazon Cognito Identity Pool.
Links the Identity Pool to the User Pool as an authentication provider, mapping users to specific IAM roles.
This generates temporary AWS credentials required for direct S3 API interaction from the client web application.

Anahtar Kavram

Amazon Cognito User Pools vs Identity Pools integration with API Gateway and S3
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru