DVA-C02 Question 130
Single answerAn e-commerce application hosted on AWS needs to authenticate users and grant temporary access to certain resources, such as S3 buckets and DynamoDB tables, based on their roles. The application uses a third-party identity provider (IdP) for user sign-in and generates JSON Web Tokens (JWT) for session management. Which approach should you use to integrate with AWS services to grant users temporary access?
- A
Use the AWS Security Token Service (STS) AssumeRoleWithWebIdentity API to exchange the JWT for temporary credentials.
- B
Store the JWT in AWS Secrets Manager and attach it to requests to AWS services.
- C
Use the AssumeRole API of AWS STS to directly assume an IAM role without validating the JWT.
- D
Embed the JWT into an AWS Lambda function and use it to request resources directly.
Show answer and explanation
Correct answer: A
Explanation
To integrate third-party identity providers with AWS services, AWS STS provides the AssumeRoleWithWebIdentity API. This API allows you to exchange a web identity token, such as a JWT, for temporary AWS credentials. These temporary credentials can be used to securely access AWS resources without needing to hard-code access keys or directly rely on the JWT for resource access.
- A. Correct.
Correct. The AWS Security Token Service (STS) AssumeRoleWithWebIdentity API is designed to work with web identity tokens like JWTs. It allows you to exchange the token for temporary AWS credentials, which can then be used to access AWS resources securely.
- B. Incorrect.
Incorrect. AWS Secrets Manager is not designed to store or process JWTs for session management. Storing the JWT here does not provide the necessary integration to grant temporary AWS credentials.
- C. Incorrect.
Incorrect. The AssumeRole API cannot directly process or validate web identity tokens like JWTs. Using AssumeRole requires an AWS principal to already have AWS credentials.
- D. Incorrect.
Incorrect. Embedding the JWT into a Lambda function and using it directly for resource requests is insecure and does not align with AWS best practices. JWTs need to be validated, and temporary credentials should be generated for AWS resource access.