SCS-C02 Question 292
Single answerAn organization is running a serverless application on AWS using Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application is accessed by multiple external clients, each requiring request authentication. The security team wants to limit the use of long-term credentials, ensure secure access for the external clients, and minimize operational overhead. What is the recommended approach to meet these requirements?
- A
Generate IAM user access keys for each external client and share them securely.
- B
Use Amazon Cognito User Pools to authenticate external clients and generate temporary tokens.
- C
Require external clients to use AWS STS AssumeRole API to get temporary credentials.
- D
Use API Gateway to issue API keys for each client and authenticate requests.
Show answer and explanation
Correct answer: B
Explanation
Using Amazon Cognito User Pools is the best solution for this scenario because it provides secure, temporary credentials to external clients, eliminates the need for long-term credentials, and integrates seamlessly with API Gateway. This approach also reduces operational overhead by managing authentication centrally.
- A. Incorrect.
Generating IAM user access keys for each client introduces long-term credentials, which are less secure and harder to manage. This approach does not minimize operational overhead.
- B. Correct.
Amazon Cognito User Pools provide a scalable solution for authentication, issuing secure, temporary tokens (JWTs) for external clients. This approach avoids long-term credentials and simplifies client access management.
- C. Incorrect.
While AWS STS can provide temporary credentials, it is designed for internal AWS resource access rather than external client authentication, making it less suitable in this scenario.
- D. Incorrect.
API Gateway API keys can help track and throttle usage but are not a secure authentication mechanism. They lack encryption and cannot replace proper identity management solutions like Cognito.