DVA-C02 Question 119
Select 2You are developing a serverless application on AWS that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application requires user authentication to access specific API routes and ensures that users have appropriate permissions to perform certain actions on the DynamoDB table. Which combination of steps should you take to implement authentication and authorization for this application?
- A
Use Amazon Cognito to create a user pool for user authentication and integrate it with API Gateway.
- B
Assign an IAM role to each user dynamically and attach it to their Amazon Cognito identity.
- C
Configure an Amazon Cognito identity pool to authorize users and issue temporary AWS credentials for accessing DynamoDB.
- D
Set up API Gateway to use a Lambda authorizer to validate user permissions before invoking the Lambda function.
- E
Manually create and manage user credentials in a custom database and validate them within Lambda.
Show answer and explanation
Correct answers: A, C
Explanation
To implement authentication and authorization in a serverless application, Amazon Cognito is the best choice. It simplifies user authentication using user pools and handles authorization to AWS services via identity pools by issuing temporary AWS credentials. This approach is scalable, secure, and integrates well with API Gateway, Lambda, and DynamoDB. Lambda authorizers and custom credential management are more complex and less suitable for this scenario.
- A. Correct.
Correct. Amazon Cognito user pools provide a managed, scalable solution for user authentication, and they integrate seamlessly with API Gateway for securing API routes.
- B. Incorrect.
Incorrect. Assigning IAM roles directly to individual users dynamically is not a recommended or scalable approach. Instead, use Amazon Cognito identity pools to manage temporary AWS credentials.
- C. Correct.
Correct. Amazon Cognito identity pools allow for authorization by issuing temporary AWS credentials to authenticated users, enabling them to securely access DynamoDB.
- D. Incorrect.
Incorrect. While Lambda authorizers can validate permissions, using Amazon Cognito for both authentication and authorization simplifies the process and reduces the need for custom logic.
- E. Incorrect.
Incorrect. Manually managing user credentials and validation increases complexity and is not recommended when Amazon Cognito provides a secure and managed solution.