DVA-C02 Question 159
Single answerA company is building an application that uses an Amazon S3 bucket to store user-uploaded images. The development team wants to ensure that only users authenticated through Amazon Cognito can upload files to the S3 bucket. How can the team implement this securely?
- A
Create an IAM policy that grants upload permissions to the S3 bucket and attach it directly to the Amazon Cognito identity pool.
- B
Configure an Amazon Cognito identity pool with appropriate roles, and use those roles to provide temporary credentials for S3 bucket upload permissions.
- C
Set a bucket policy on the S3 bucket to allow uploads from all authenticated users without requiring additional IAM roles.
- D
Manually create IAM users for each application user and assign them S3 upload permissions.
Show answer and explanation
Correct answer: B
Explanation
The best practice for securely allowing users authenticated through Amazon Cognito to upload files to an S3 bucket is to use Amazon Cognito identity pools. These pools enable the application to provide temporary AWS credentials to users, which are linked to roles that define specific permissions. This approach avoids the need to manually create IAM users or apply overly permissive bucket policies.
- A. Incorrect.
IAM policies cannot be directly attached to an Amazon Cognito identity pool. Instead, you must configure roles that are assumed by authenticated users through the pool.
- B. Correct.
This is the correct approach. Amazon Cognito identity pools can be configured to provide temporary AWS credentials through IAM roles. These roles can include permissions for specific actions, such as uploading files to an S3 bucket.
- C. Incorrect.
Setting a bucket policy to allow uploads from all authenticated users without further restrictions could expose the bucket to unauthorized access. Additionally, Cognito roles are preferred for fine-grained permissions.
- D. Incorrect.
Manually creating IAM users for each application user is not scalable or secure, especially in applications where user authentication and authorization are managed by a service like Amazon Cognito.