Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is implementing secure client-side uploads for a mobile application. The application must allow authenticated users to upload files to their own prefix in an Amazon S3 bucket named app-user-data\text{app-user-data} using temporary credentials provided by Amazon Cognito Identity Pools. The target prefix is cognito/${cognito−identity.amazonaws.com:sub}/\text{cognito/}\$\{cognito-identity.amazonaws.com:sub\}/, where $${cognito−identity.amazonaws.com:sub}\$\$\{cognito-identity.amazonaws.com:sub\} represents the user's Cognito Identity ID.

Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

  1. In the IAM permissions policy attached to the authenticated role, define the S3 resource path as arn:aws:s3:::app-user-data/cognito/${cognito−identity.amazonaws.com:sub}/∗\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/* and allow the s3:PutObject\text{s3:PutObject} action.Cevap
  2. Configure the trust policy of the authenticated IAM role to allow the cognito-identity.amazonaws.com\text{cognito-identity.amazonaws.com} service principal to call the sts:AssumeRoleWithWebIdentity\text{sts:AssumeRoleWithWebIdentity} action.Cevap
  3. C
    Hardcode the AWS credentials of an IAM User with full S3 write permissions inside the mobile application code to initialize the S3 client wrapper.
  4. D
    Add a trust relationship directly to the Amazon S3 bucket policy allowing the cognito-identity.amazonaws.com\text{cognito-identity.amazonaws.com} service principal to assume the bucket's permissions.
  5. E
    Configure the trust policy of the authenticated IAM role to allow the cognito-idp.amazonaws.com\text{cognito-idp.amazonaws.com} service principal to call the sts:AssumeRole\text{sts:AssumeRole} action.

Cevap

Configure the trust policy of the authenticated IAM role to allow the federated principal cognito-identity.amazonaws.com\text{cognito-identity.amazonaws.com} to call the sts:AssumeRoleWithWebIdentity\text{sts:AssumeRoleWithWebIdentity} action. Additionally, in the IAM permissions policy attached to this role, allow the s3:PutObject\text{s3:PutObject} action on the resource path arn:aws:s3:::app-user-data/cognito/${cognito−identity.amazonaws.com:sub}/∗\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*.
To allow client-side users authenticated with Cognito Identity Pools to access AWS resources, the authenticated IAM role must establish a trust relationship with the identity pool provider principal cognito-identity.amazonaws.com\text{cognito-identity.amazonaws.com} and allow the sts:AssumeRoleWithWebIdentity\text{sts:AssumeRoleWithWebIdentity} API action. To secure user uploads to S3, the attached permissions policy must grant s3:PutObject\text{s3:PutObject} access to the user-specific prefix, utilizing the dynamic policy variable $${cognito−identity.amazonaws.com:sub}\$\$\{cognito-identity.amazonaws.com:sub\} to enforce user isolation.

Adım Adım Çözüm

1
Configure the trust policy of the IAM role to permit web identity federation.
The identity pool service principal cognito-identity.amazonaws.com\text{cognito-identity.amazonaws.com} is allowed to assume the role using sts:AssumeRoleWithWebIdentity\text{sts:AssumeRoleWithWebIdentity}.
This establishes trust between Amazon Cognito Identity Pools and the IAM role, enabling the exchange of Cognito tokens for temporary AWS security credentials.
2
Define dynamic resource-level S3 permissions using Cognito policy variables.
The IAM policy allows s3:PutObject\text{s3:PutObject} specifically on resource arn:aws:s3:::app-user-data/cognito/${cognito−identity.amazonaws.com:sub}/∗\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*.
The dynamic variable $${cognito−identity.amazonaws.com:sub}\$\$\{cognito-identity.amazonaws.com:sub\} resolves to the current user's unique identity ID at runtime, isolating S3 uploads per user.

Anahtar Kavram

Configuring IAM Trust Policies and Identity Pool Variables for Dynamic Resource Isolation
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru