Q57 — AWS SAA-C03 Ch.14

Question 57 of 100 | ← Chapter 14

Q1057. A company hosts an application in a private subnet. The company has already integrated the application with Amazon Cognito. The company uses an Amazon Cognito user pool to authenticate users.The company needs to modify the application so the application can securely store user documents in an Amazon S3 bucket.Which combination of steps will securely integrate Amazon S3 with the application? (Choose two.)

• A. Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in. ✓
• B. Use the existing Amazon Cognito user pool to generate Amazon S3 access tokens for users when they successfully log in.
• C. Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application. ✓
• D. Create a NAT gateway in the VPC where the company hosts the application. Assign a policy to the S3 bucket to deny any request that is not initiated from Amazon Cognito.
• E. Attach a policy to the S3 bucket that allows access only from the users' IP addresses.

Correct Answer: A. Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in., C. Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application.

Explanation

To securely integrate Amazon S3 with the application that uses Amazon Cognito for user authentication, the best combination of steps is:A. Create an Amazon Cognito identity pool to generate secure Amazon S3 access tokens for users when they successfully log in.C. Create an Amazon S3 VPC endpoint in the same VPC where the company hosts the application.Explanation:\1. A. Create an Amazon Cognito identity pool: - An Amazon Cognito identity pool allows you to authenticate users and obtain temporary AWS credentials. This is essential for securely granting users access to Amazon S3. When users log in through the user pool, you can use the identity pool to generate AWS access tokens that allow secure interactions with S3.\2. C. Create an Amazon S3 VPC endpoint: - By creating an S3 VPC endpoint, you allow your application to access S3 without needing to route traffic over the public internet. This enhances security by keeping the data transfer within the AWS network, and it helps comply with security protocols for private subnet access.Evaluation of Other Options:B. Use the existing Amazon Cognito user pool: - While the user pool handles authentication, it does not directly generate AWS credentials for S3 access. An identity pool is necessary for this purpose.D. Create a NAT gateway in the VPC: - A NAT gateway is used for enabling outbound internet access for resources in a private subnet, but it is not required for accessing S3 when using a VPC endpoint. Additionally, denying access based solely on the origin of requests through Cognito may not be appropriate.E. Attach a policy to the S3 bucket that allows access only from the users' IP addresses: - This approach can lead to issues, especially in dynamic IP environments where user IP addresses may change frequently. It is not a practical solution for managing access.Conclusion:The combination of A and C provides a secure and efficient way to integrate Amazon S3 with the application while leveraging Amazon Cognito for user authentication and ensuring secure connectivity within a private subnet.