Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is building a serverless web portal for a medical scheduling system. Users must authenticate using their corporate Google Workspace accounts through OpenID Connect (OIDC). Once authenticated, the web portal must invoke private API routes hosted on Amazon API Gateway. The developer needs to validate the user session token at the API Gateway layer with the least operational overhead and without writing custom validation code.

Which solution meets these requirements?

  1. Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.Cevap
  2. B
    Configure an Amazon Cognito Identity Pool federated with the Google Workspace OIDC provider, enable AWS IAM authorization on API Gateway, and sign the client API requests using AWS Signature Version 4.
  3. C
    Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and write a custom API Gateway Lambda authorizer to parse and validate the JSON Web Tokens (JWT) manually.
  4. D
    Configure an Amazon Cognito Identity Pool federated with the Google Workspace OIDC provider, and create an API Gateway Cognito authorizer linked to the Identity Pool to validate the client tokens.

Cevap

Configure an Amazon Cognito User Pool federated with the Google Workspace OIDC provider, and set up an API Gateway Cognito authorizer that directly validates the identity tokens.
The correct solution uses an Amazon Cognito User Pool to handle the OpenID Connect federation with Google Workspace, which issues standard JSON Web Tokens. By using the built-in API Gateway Cognito authorizer, API Gateway validates these tokens automatically, eliminating the need to write custom validation logic or perform complex request signing on the client.

Adım Adım Çözüm

1
Determine if User Pools or Identity Pools are appropriate for the user federation and token generation requirement.
Amazon Cognito User Pools is chosen to act as the user directory and federated identity consumer for the OIDC provider (Google Workspace).
User Pools are used for authentication and directories, producing JSON Web Tokens (JWTs) such as identity and access tokens.
2
Select the API Gateway authorizer that validates the authentication tokens with the least operational overhead.
Select the built-in API Gateway Cognito authorizer.
API Gateway's native Cognito authorizer handles JWT validation out of the box, requiring zero custom code and removing the need to manage Lambda functions or sign requests using Signature Version 4.

Anahtar Kavram

Selecting the correct Cognito service and API Gateway authorizer type to minimize custom development when integrating external identity providers.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru