Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

An engineering team is designing a client-side web application that integrates with an external OpenID Connect (OIDC) identity provider. Once authenticated, the web application must upload session logs directly to a specific folder within an Amazon S3 bucket (e.g., logs/{user_id}/). To minimize transfer latency and backend compute costs, the logs must be uploaded directly from the browser. Which architecture meets these requirements with the least operational overhead?

  1. A
    Create an IAM Role with a trust policy that allows the sts:AssumeRole action for the client application. Hardcode the IAM Role ARN in the client application, and have the client call AWS STS directly to assume the role using the OIDC token.
  2. Configure an Amazon Cognito Identity Pool, register the OIDC provider as an authentication provider, and assign an authenticated IAM role. Use an IAM policy for this role that grants S3 write permissions to resources matching arn:aws:s3:::my-bucket/logs/${cognito-identity.amazonaws.com:sub}/*.Cevap
  3. C
    Configure an Amazon Cognito User Pool, register the OIDC provider as a federated Identity Provider (IdP), and configure a custom attribute to map the user ID to S3 folder access. Use the User Pool ID token directly to authenticate and authorize the client's S3 uploads.
  4. D
    Create an Amazon API Gateway REST API with a custom Lambda Authorizer. Have the authorizer validate the OIDC tokens, call AWS Security Token Service (STS) to generate temporary credentials, and return these credentials to the client to perform the S3 uploads.

Cevap

Configure an Amazon Cognito Identity Pool, register the OIDC provider as an authentication provider, and assign an authenticated IAM role. Use an IAM policy for this role that grants S3 write permissions to resources matching the user's Cognito identity ID.
Using an Amazon Cognito Identity Pool is the standard, least-overhead method to exchange external OIDC identity tokens for temporary, limited-privilege AWS credentials. The identity pool acts as the credential provider, mapping the OIDC token to an authenticated IAM role. By using the policy variable ${cognito-identity.amazonaws.com:sub}, you can dynamically restrict users to their specific folders within the S3 bucket without requiring custom backend code.

Adım Adım Çözüm

1
Configure an Amazon Cognito Identity Pool and configure it to trust the external OIDC identity provider.
Enables the client-side application to present OIDC tokens to Cognito in exchange for a unique Cognito Identity ID.
Identity Pools are the service component responsible for federating identity providers to authorize AWS resource access.
2
Assign an authenticated IAM role to the Identity Pool, representing signed-in users.
Users who present valid OIDC tokens will automatically assume this role and receive temporary AWS credentials.
IAM roles define what permissions the authenticated identity has within the AWS environment.
3
Apply a policy to the IAM role that uses the dynamic variable ${cognito-identity.amazonaws.com:sub} in the S3 resource ARN.
Enforces fine-grained isolation, ensuring users can only write to their own folder within the S3 bucket.
This avoids hardcoding or managing individual folders manually, providing secure and automated resource isolation.

Anahtar Kavram

Amazon Cognito Identity Pools broker temporary AWS credentials for federated users, allowing direct and secure access to AWS resources like S3 using dynamic policy variables.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru