Examkin

Soru

Zorluk: ZorAmazon Cognito Authentication and Authorization

A developer is building a web application that stores user-specific files in a private Amazon S3 bucket. The application uses an Amazon Cognito User Pool for user authentication. The developer wants to authorize users to access their department's files in S3 using temporary AWS credentials. The user's department is stored in a custom attribute named custom:department in the User Pool. The developer has created a separate IAM role for each department. Which approach should the developer use to assign the correct IAM role to each user with the least operational overhead?

  1. Create an Amazon Cognito Identity Pool and add the User Pool as an identity provider. Configure rules-based role mapping on the identity provider to match the custom:department claim in the ID token to the corresponding IAM role.Cevap
  2. B
    Configure the Amazon Cognito User Pool to issue temporary AWS credentials directly by mapping the custom:department attribute to the AWS STS AssumeRole API parameters in the User Pool app client settings.
  3. C
    Create an Amazon Cognito Identity Pool with a single authenticated role. Use the IAM policy variable ${cognito-identity.amazonaws.com:custom:department} in the role's permission policy to dynamically grant access to the department's S3 folder.
  4. D
    Configure an API Gateway REST API with a custom Lambda authorizer that validates the User Pool ID token and calls the AWS STS AssumeRole API to generate and return temporary credentials to the client.

Cevap

Create an Amazon Cognito Identity Pool, add the User Pool as an identity provider, and configure rules-based role mapping on the identity provider to match the custom:department claim in the ID token to the corresponding IAM role.
The correct solution uses an Amazon Cognito Identity Pool to exchange the ID token from the User Pool for temporary AWS credentials. By configuring rules-based role mapping on the User Pool identity provider within the Identity Pool, the developer can inspect the custom:department claim present in the authenticated user's ID token and dynamically assign the corresponding department-specific IAM role. This requires zero custom code and leverages native AWS features, minimizing operational overhead.

Adım Adım Çözüm

1
Identify the separation of concerns between Amazon Cognito User Pools and Identity Pools.
Confirm that User Pools handle authentication (user sign-in and profile attributes) while Identity Pools handle authorization (exchanging tokens for temporary AWS credentials).
Since the client needs direct access to S3, temporary AWS credentials must be vended via an Identity Pool.
2
Determine how to map the custom attribute from the User Pool to the required IAM role.
Leverage the rules-based role mapping feature of Cognito Identity Pools.
Rules-based mapping allows evaluating the custom:department claim from the ID token and dynamically assigning one of the pre-created department-specific IAM roles.
3
Eliminate options that introduce unnecessary custom code or rely on unsupported policy variables.
Reject solutions involving custom Lambda authorizers on API Gateway or unsupported Cognito Identity Pool policy variables.
These alternatives increase operational complexity and fail to utilize the built-in, native integrations of Amazon Cognito.

Anahtar Kavram

Role mapping in Amazon Cognito Identity Pools based on Cognito User Pool ID token claims
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru