Examkin

Soru

Zorluk: KolayAmazon Cognito Authentication and Authorization

A developer is building a serverless web application. The application requires users to register and sign in. Additionally, authenticated users must be allowed to upload files directly to a private Amazon S3 bucket. Which TWO Amazon Cognito components are required to meet these requirements?

  1. An Amazon Cognito User Pool to manage user registration, authentication, and the user directoryCevap
  2. An Amazon Cognito Identity Pool to authorize users and provide temporary AWS credentials for accessing the Amazon S3 bucketCevap
  3. C
    A custom Amazon API Gateway Lambda Authorizer to generate temporary IAM credentials for direct Amazon S3 bucket access
  4. D
    An Amazon Cognito User Pool configured to directly issue temporary AWS credentials to the client web application
  5. E
    An Amazon API Gateway Cognito Authorizer configured to authorize direct uploads to the Amazon S3 bucket

Cevap

The developer must use an Amazon Cognito User Pool to manage user registration, authentication, and the user directory, alongside an Amazon Cognito Identity Pool to authorize users and provide temporary AWS credentials for accessing the Amazon S3 bucket.
To implement user authentication (sign-up, sign-in, directory), a Cognito User Pool is required. To authorize the users to access AWS resources directly, such as uploading files to Amazon S3, an Amazon Cognito Identity Pool is required to exchange the User Pool tokens for temporary AWS IAM credentials.

Adım Adım Çözüm

1
Implement a user directory and sign-up/sign-in flows using Amazon Cognito User Pools.
Users are authenticated and receive JSON Web Tokens (JWTs) representing their identity.
To verify user identities and manage their authentication status.
2
Configure an Amazon Cognito Identity Pool and link it to the Cognito User Pool.
The client application can exchange the User Pool JWTs for temporary AWS credentials.
To authorize authenticated users to access AWS services directly.
3
Assign an IAM Role to the authenticated user group in the Identity Pool with permissions to write to the Amazon S3 bucket.
The temporary AWS credentials grant the necessary permissions to write files directly to Amazon S3.
To enforce fine-grained access control on the target AWS resource.

Anahtar Kavram

Distinction between Amazon Cognito User Pools (authentication and identity directory) and Identity Pools (authorization and temporary AWS credentials).
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru