AWS Certified Developer – Associate (DVA-C02)SecurityMedium
A developer is building a web application that authenticates users using Amazon Cognito User Pools. After successful authentication, the application needs to access AWS resources, such as an Amazon S3 bucket, on behalf of the authenticated user. What is the most secure and recommended way for the application to obtain temporary, limited-privilege credentials for accessing these AWS resources?
- AGrant the Cognito User Pool direct access to the S3 bucket.
- BStore AWS access keys and secret keys directly in the application code and use them.
- CUse an IAM user's long-term access keys and secret keys directly in the application.
- DExchange the Cognito Identity Pool credentials for temporary AWS credentials.
Show answer & explanationAnswer & explanation
Correct answer: D. Exchange the Cognito Identity Pool credentials for temporary AWS credentials.
After a user authenticates with a Cognito User Pool, you can integrate with an Identity Pool to exchange the User Pool tokens for temporary, limited-privilege AWS credentials. These credentials can then be used by the application to access AWS resources securely.
Why the other options are wrong
- A. Cognito User Pools manage user authentication, not direct access to AWS resources. Identity Pools are required to bridge this gap.
- B. Hardcoding credentials is a severe security risk and is against AWS best practices.
- C. Using long-term IAM user credentials directly in an application is a security risk and makes credential rotation and management difficult.
Cognito Identity Pools
An AWS service that provides temporary AWS credentials for users authenticated through various identity providers (e.g., Cognito User Pools, social logins) to access AWS services.
- Federates identities to grant AWS access.
- Provides temporary, limited-privilege credentials.
- Supports both authenticated and unauthenticated identities.
Memory trick: User Pools authenticate, Identity Pools authorize AWS access.