Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is building a web application where users sign in via social identity providers. The application needs to call a backend REST API on Amazon API Gateway, and also allow users to upload user profile photos directly to a private Amazon S3 bucket.

Which Cognito configuration meets these requirements with the least operational overhead?

  1. A
    Configure a Cognito User Pool to handle user sign-in. Secure the REST API using an API Gateway Cognito user pool authorizer. Configure the private S3 bucket to allow public write access restricted by a bucket policy that validates the Cognito User Pool ID token.
  2. B
    Configure a Cognito User Pool to handle user sign-in. Configure a custom Lambda authorizer on API Gateway to validate the User Pool token and generate temporary AWS credentials to return to the client for S3 access.
  3. Configure a Cognito User Pool to handle user sign-in and social provider federation. Secure the REST API using an API Gateway Cognito user pool authorizer. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to authorize direct S3 uploads.Cevap
  4. D
    Configure a Cognito Identity Pool to handle user sign-in and social identity federation. Use a custom Lambda authorizer on API Gateway to validate the Cognito Identity Pool tokens, and grant the REST API IAM permissions to write to the S3 bucket on behalf of the users.

Cevap

Configure a Cognito User Pool to handle user sign-in and social provider federation. Secure the REST API using an API Gateway Cognito user pool authorizer. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to authorize direct S3 uploads.
The correct configuration uses a Cognito User Pool for user sign-in and identity federation, securing API Gateway endpoints using a built-in Cognito authorizer which natively validates the JSON Web Tokens (JWTs). It then uses a Cognito Identity Pool to trade the authenticated User Pool token for temporary AWS IAM credentials, allowing the application client to perform direct uploads to S3 with minimal operational overhead.

Adım Adım Çözüm

1
Identify the authentication and user management component.
A Cognito User Pool is selected to manage user profiles, sign-ins, and social identity provider federation.
User Pools act as the primary user directory and issue identity tokens.
2
Select the API authorization mechanism.
Use the built-in API Gateway Cognito user pool authorizer to validate the JWTs sent by the client.
This integration handles token validation automatically with zero custom code or Lambda overhead.
3
Determine how the client obtains credentials for direct S3 access.
Configure a Cognito Identity Pool that trusts the Cognito User Pool, allowing the client to exchange its user token for temporary AWS IAM credentials.
Amazon S3 requires AWS IAM credentials for secure client-side uploads, which is the primary purpose of Identity Pools.

Anahtar Kavram

Federating user sign-in with Cognito User Pools and obtaining temporary AWS credentials via Cognito Identity Pools for S3 access.
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru