A company is creating a customer portal where registered users can log in and view their monthly account statements. These statements are stored in a private Amazon S3 bucket. The developer needs to implement a solution that authenticates users, manages their accounts, and provides them with temporary, limited-privilege AWS credentials to download their statements directly from S3.
Which Amazon Cognito configuration should the developer use to meet these requirements?
- AConfigure a Cognito Identity Pool to handle user registration and login, and write an IAM trust policy that allows the Identity Pool to directly generate permanent AWS credentials for S3 access.
- BConfigure a Cognito User Pool to handle user registration and login, and implement a custom Lambda Authorizer on the S3 bucket to validate user sessions and grant access.
- Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.Cevap
- DConfigure a Cognito User Pool to handle user registration and login, and attach an IAM policy directly to the User Pool to grant S3 access to authenticated users.
Cevap
Configure a Cognito User Pool to handle user registration and login, and associate it with a Cognito Identity Pool to exchange the identity token for temporary AWS credentials that allow S3 access.
The correct solution uses a Cognito User Pool to handle registration and authentication (acting as the user directory and producing identity tokens) and exchanges these tokens via a Cognito Identity Pool to obtain temporary AWS credentials with permissions to retrieve files from the Amazon S3 bucket.
Adım Adım Çözüm
Anahtar Kavram
Cognito User Pools handle authentication (user directory), while Cognito Identity Pools handle authorization (temporary AWS credentials for AWS services).