Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is building an enterprise web application. The application must authenticate corporate users using an external SAML 2.0 Identity Provider (IdP) and provide them with access to two resources: a secure REST API hosted on Amazon API Gateway, and a private Amazon S3 bucket for uploading reports directly from the client.

Which TWO configurations are required to meet these requirements? (Select TWO.)

  1. Configure an Amazon Cognito User Pool with the external SAML Identity Provider (IdP) to handle user authentication, and set up an API Gateway Cognito Authorizer using the User Pool's tokens.Cevap
  2. Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with write permissions to the Amazon S3 bucket.Cevap
  3. C
    Configure an API Gateway Lambda Authorizer to validate the SAML token and generate temporary IAM credentials to allow the client to upload files to the Amazon S3 bucket.
  4. D
    Configure the Amazon Cognito User Pool to directly issue temporary AWS credentials to the client application upon successful SAML federation.
  5. E
    Configure a Cognito User Pool resource server with custom OAuth 2.0 scopes to authorize direct file uploads to the Amazon S3 bucket.

Cevap

Configure an Amazon Cognito User Pool with the external SAML Identity Provider (IdP) to handle user authentication, and set up an API Gateway Cognito Authorizer using the User Pool's tokens. In addition, configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with write permissions to the Amazon S3 bucket.
The correct architecture uses an Amazon Cognito User Pool to federate authentication with the SAML Identity Provider (IdP) and secures the API Gateway using a Cognito Authorizer with the generated JWT. It also uses an Amazon Cognito Identity Pool (Federated Identities) to exchange the User Pool JWT for temporary AWS credentials defined by an authenticated IAM role, enabling the client application to upload reports directly to Amazon S3.

Adım Adım Çözüm

1
Federate SAML 2.0 IdP with Cognito User Pool
Users can authenticate against the corporate directory, and Cognito User Pool issues ID and access JWT tokens to the client.
This establishes user identity and generates tokens to verify the user's session.
2
Secure the API Gateway REST API with a Cognito User Pool Authorizer
API Gateway automatically validates the Cognito JWT token on incoming requests.
This verifies that the caller has been authenticated by the User Pool before forwarding the request to downstream services.
3
Configure a Cognito Identity Pool linked to the User Pool
The Identity Pool validates the User Pool ID token and maps the authenticated user to an IAM role.
This enables the exchange of the Cognito JWT for temporary, limited-privilege AWS credentials (access key, secret key, session token) which are required to write objects directly to the Amazon S3 bucket.

Anahtar Kavram

Integration of Cognito User Pools for user directory/federation and Cognito Identity Pools for temporary AWS credential delegation.
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru