Examkin

Soru

Zorluk: OrtaApplication Authentication and Authorization with Amazon Cognito

An enterprise has a backend service running on Amazon EC2 that needs to securely communicate with a protected REST API hosted on Amazon API Gateway. There is no user interaction involved in this communication. The developer wants to implement a secure, scalable authentication and authorization mechanism using Amazon Cognito to protect the API. How should the developer configure Amazon Cognito and API Gateway to meet these requirements with the least operational overhead?

  1. A
    Configure an Identity Pool to authenticate the backend service, retrieve temporary AWS credentials, and use these credentials to sign the requests using Signature Version 4 while using IAM authorization on the API Gateway.
  2. B
    Create a User Pool with client credentials grant enabled, and configure a custom Lambda authorizer on the API Gateway to verify, decode, and parse the signature of the Cognito JSON Web Token (JWT).
  3. Create a User Pool and configure a resource server with custom scopes. Enable the client credentials flow for the service's app client, and use the built-in Cognito authorizer on the API Gateway to validate the incoming access token.Cevap
  4. D
    Create a User Pool and an IAM role with a trust policy allowing API Gateway to assume it. Have the backend service exchange its user pool credentials for the IAM role using the AWS Security Token Service (STS) prior to each request.

Cevap

Create a User Pool and configure a resource server with custom scopes. Enable the client credentials flow for the service's app client, and use the built-in Cognito authorizer on the API Gateway to validate the incoming access token.
The correct option is the one that suggests creating a User Pool and configuring a resource server with custom scopes, enabling the client credentials flow, and utilizing the built-in Cognito authorizer on API Gateway. For machine-to-machine (M2M) communication without user intervention, the OAuth 2.0 client credentials grant is the industry standard. Amazon Cognito User Pools natively support this flow through resource servers. Additionally, API Gateway provides a built-in Cognito User Pool authorizer that automatically validates the signature and expiration of the access token, as well as checking custom scopes, minimizing custom code and operational overhead.

Adım Adım Çözüm

1
Identify the client context and authentication flow.
The client is a backend machine-to-machine (M2M) service, which requires the OAuth 2.0 client credentials grant.
There is no user interaction, making standard user flows (like authorization code or implicit flows) unsuitable.
2
Select the appropriate Amazon Cognito resource type.
A Cognito User Pool is used, defining a resource server with custom scopes.
Cognito User Pools manage authentication and directories, and custom scopes allow application-level authorization. Cognito Identity Pools are meant for temporary AWS credential vending.
3
Configure the API Gateway authorization mechanism.
Utilize the built-in Amazon Cognito User Pool authorizer.
The built-in authorizer validates JWT access tokens automatically without the operational overhead of writing and maintaining a custom Lambda authorizer.

Anahtar Kavram

Machine-to-machine authentication using Cognito User Pools and API Gateway Cognito Authorizers
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Application Authentication and Authorization with Amazon Cognito

Bu konudan daha fazla soru