DVA-C02 Question 117
Select 3You are developing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users using Amazon Cognito and allow different levels of access based on their roles. Which steps should you take to implement this authentication and authorization solution?
- A
Configure an Amazon Cognito User Pool and integrate it with the API Gateway for user authentication.
- B
Use API Gateway resource policies to restrict access based on IP addresses.
- C
Set up an Amazon Cognito Identity Pool to map user roles to IAM roles for role-based access control.
- D
Attach an application-specific Lambda authorizer to API Gateway to perform user authentication.
- E
Enable the 'Authorization' setting in API Gateway and select the Amazon Cognito User Pool as the authorizer.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement authentication and authorization for the application, you should use Amazon Cognito User Pools to authenticate users and integrate them with API Gateway. For role-based access control, you can leverage Amazon Cognito Identity Pools to map user roles to specific IAM roles. Finally, enabling the 'Authorization' setting in API Gateway and selecting the Cognito User Pool as the authorizer ensures that only authenticated users can access the API endpoints. Resource policies and Lambda authorizers are not necessary in this scenario because Cognito provides a native solution for both user authentication and role-based access control.
- A. Correct.
Correct. Amazon Cognito User Pools provide user authentication, and API Gateway can integrate directly with a User Pool to handle authentication for your application.
- B. Incorrect.
Incorrect. While API Gateway resource policies are useful for restricting access based on IP addresses, they are not relevant for user authentication or role-based access control.
- C. Correct.
Correct. Amazon Cognito Identity Pools allow you to map authenticated users to specific IAM roles, enabling role-based access control for different levels of authorization.
- D. Incorrect.
Incorrect. A Lambda authorizer is not required in this case because Amazon Cognito User Pools natively handle authentication and can integrate directly with API Gateway.
- E. Correct.
Correct. Enabling the 'Authorization' setting in API Gateway and selecting an Amazon Cognito User Pool as the authorizer ensures that only authenticated users can access the API.