Examkin

Soru

Zorluk: ZorAmazon Cognito Authentication and Authorization

A developer is designing a web-based smart-home dashboard. Users must sign in using an external corporate OpenID Connect (OIDC) identity provider. After signing in, the dashboard client application must be able to:

1. Invoke an Amazon API Gateway REST API to retrieve telemetry data, using the user's authenticated profile to authorize the requests.
2. Download device logs directly from a private Amazon S3 bucket, where each user has access only to their own device subfolder (prefixed with their user ID).

Which TWO configurations are required to meet these requirements with the least operational overhead? (Select TWO.)

  1. Configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, and configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API.Cevap
  2. Configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, and associate an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.Cevap
  3. C
    Configure an Amazon Cognito User Pool, and map the OIDC claims to local attributes to generate temporary AWS credentials directly within the User Pool for direct S3 access.
  4. D
    Create a custom Amazon API Gateway Lambda authorizer that retrieves OIDC provider public keys, verifies the JWT, and calls the STS AssumeRole API to return temporary AWS credentials back to the client application for S3 access.
  5. E
    Create an IAM User with a policy allowing read access to the S3 bucket, configure the User Pool to distribute the IAM User's access key and secret key to the client application, and initialize the AWS SDK client.

Cevap

The developer must configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API, and configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, associating an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.
To authenticate external OIDC users and secure the API Gateway REST API, the developer should configure an Amazon Cognito User Pool with the OIDC provider as a federated identity provider, and secure the API Gateway with a built-in Cognito authorizer. To allow secure, direct S3 downloads using dynamic user-specific prefixes, the developer should configure an Amazon Cognito Identity Pool linked to the User Pool, and map authenticated users to an IAM role that uses policy variables to restrict access to their specific directory prefix.

Adım Adım Çözüm

1
Set up User Authentication
Configure an Amazon Cognito User Pool to federate with the external OIDC provider. This allows the web dashboard client to authenticate users and obtain JSON Web Tokens (JWTs) representing their identity.
Cognito User Pools serve as the identity directory and handle the OIDC handshake, token issuance, and user profile management.
2
Secure API Gateway REST API
Configure a built-in Cognito Authorizer on Amazon API Gateway REST API pointing to the User Pool. The client will pass the identity token in the authorization header.
Using the built-in Cognito Authorizer validates the JWT signature and expiration automatically, reducing operational overhead and custom code.
3
Enable Fine-Grained AWS Resource Access
Create a Cognito Identity Pool (federated identities) and configure the User Pool as an authentication provider. Map the authenticated role to an IAM role that permits S3 operations on prefixes filtered by the Cognito identity ID policy variable.
Cognito Identity Pools exchange the User Pool JWT for temporary, limited-privilege AWS credentials, allowing direct, secure S3 downloads without exposing long-lived IAM keys.

Anahtar Kavram

Cognito User Pools authenticate users and issue tokens, while Cognito Identity Pools authorize access to AWS resources by exchanging these tokens for temporary AWS credentials.
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru