A security engineer is working with a product team building a web application on AWS. The application uses Amazon S3 to host the static content, Amazon API Gateway to provide RESTful services, and…

Question

Options

• ACreate a custom authorization service using AWS Lambda.
• BConfigure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito
• CConfigure the SAML identity provider to add the Amazon Cognito user pool as a relying party.
• DConfigure an Amazon Cognito identity pool to integrate with social login providers.
• EUpdate DynamoDB to store the user email addresses and passwords.
• FUpdate API Gateway to use a COGNITO_USER_POOLS authorizer.

• A
  17% (8)
• B
  72% (33)
• D
  4% (2)
• E
  7% (3)

Explanation

Using Amazon Cognito as the federation layer is the right approach here: B configures Cognito to trust the existing SAML identity provider and map its attributes into a Cognito user pool, C registers the Cognito user pool as a relying party (service provider) in the SAML IdP so it knows to send assertions to Cognito, and F locks down API Gateway so that only requests bearing valid Cognito-issued tokens can call the APIs - completing the full auth flow without custom code.

Why the distractors fail:

• A (custom Lambda authorizer) is unnecessary complexity when Cognito natively supports SAML federation - reinventing the wheel.
• D (identity pool with social login) is for federating with Google/Facebook/Amazon, not an enterprise SAML directory.
• E (storing passwords in DynamoDB) is a serious anti-pattern and redundant - the whole point of SAML is that the IdP owns credentials, not your application.

Memory tip: Think of it as a three-handshake sequence - Cognito learns the IdP (B), the IdP learns Cognito (C), API Gateway trusts Cognito (F). Each step is a "trust registration" in one direction of the chain: IdP → Cognito → API Gateway.

No community discussion yet for this question.