SCS-C02 Question 189
Single answerA company is running its web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires user authentication and needs to securely validate JSON Web Tokens (JWTs) passed in the HTTP headers of incoming requests. The company wants to ensure that only authenticated users can access the application and would like to offload the authentication process to AWS services to reduce the complexity in their application code. Which solution best meets these requirements?
- A
Use AWS WAF with a custom rule to validate the JWTs in incoming requests.
- B
Configure Amazon Cognito to handle user authentication and integrate it with the Application Load Balancer's authentication feature.
- C
Implement a Lambda@Edge function with Amazon CloudFront to validate the JWTs before forwarding requests to the ALB.
- D
Configure an EC2 instance as a reverse proxy to validate the JWTs and forward only authenticated requests to the ALB.
Show answer and explanation
Correct answer: B
Explanation
The best solution is to use Amazon Cognito in combination with the Application Load Balancer's native authentication capabilities. Cognito handles user authentication and issues JWTs, which the ALB can validate without requiring changes to the application code. This solution offloads authentication complexity to AWS services, aligns with best practices, and minimizes operational overhead.
- A. Incorrect.
AWS WAF cannot validate JWTs natively. WAF is designed for web application security, such as blocking malicious traffic, but it does not provide JWT validation functionality.
- B. Correct.
Amazon Cognito can handle user authentication and provide JWTs for authenticated users. When integrated with an ALB, the ALB can directly validate these JWTs, offloading authentication from the application code.
- C. Incorrect.
While Lambda@Edge with CloudFront could validate JWTs, this approach is unnecessarily complex and not as cost-effective or straightforward as using ALB with Amazon Cognito for this use case.
- D. Incorrect.
Using an EC2 instance as a reverse proxy to validate JWTs requires custom code and management overhead, which contradicts the goal of offloading complexity to AWS services.