Cognito for user authentication in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does AWS Cognito handle user sign-up confirmation?

When a user signs up in AWS Cognito User Pool, what is the default behavior for confirming the user's account?

A The user must confirm their account by entering a verification code sent via email or SMS.

B The user is automatically confirmed without any additional action.

C The administrator must manually confirm the user in the AWS Console.

D The user is blocked until they reset their password.

💡 Hint

Think about how AWS Cognito verifies the user's contact information during sign-up.

By default, AWS Cognito sends a verification code to the user's email or phone number. The user must enter this code to confirm their account.

❓ Architecture

intermediate

Choosing the right AWS Cognito feature for social login

You want to allow users to sign in using their Google or Facebook accounts. Which AWS Cognito feature should you use?

A Use Cognito User Pools with Identity Providers configured for Google and Facebook.

B Use Cognito Identity Pools only, without User Pools.

C Use AWS IAM roles directly for social login.

D Use AWS Lambda triggers to authenticate social users manually.

💡 Hint

Consider which Cognito service manages user authentication and supports social identity providers.

Cognito User Pools support federated identity providers like Google and Facebook, enabling social login integration.

❓ security

advanced

Securing AWS Cognito User Pool with multi-factor authentication (MFA)

You want to enforce MFA for all users in your Cognito User Pool. Which configuration achieves this?

A Set MFA configuration to 'OPTIONAL' and enable SMS-based MFA as a second factor.

B Set MFA configuration to 'ON' and enable SMS or TOTP as second factors for all users.

C Set MFA configuration to 'OFF' and require users to enable MFA themselves.

D Disable MFA and rely on password complexity only.

💡 Hint

Think about how to enforce MFA for every user, not just optionally.

Setting MFA to 'ON' enforces multi-factor authentication for all users. You can choose SMS or TOTP as the second factor.

❓ Configuration

advanced

AWS Cognito Identity Pool role assignment behavior

In an AWS Cognito Identity Pool, how does the service assign IAM roles to authenticated users?

A All authenticated users receive the same IAM role regardless of identity provider.

B IAM roles are assigned randomly to distribute permissions evenly.

C Users must manually select their IAM role during sign-in.

D IAM roles are assigned based on rules that match the user's identity provider and attributes.

💡 Hint

Consider how Identity Pools use rules to provide fine-grained access control.

Identity Pools use role mapping rules to assign IAM roles based on the user's identity provider and attributes, enabling different permissions.

✅ Best Practice

expert

Minimizing security risks with AWS Cognito Lambda triggers

You use AWS Cognito Lambda triggers to customize user authentication flows. What is a best practice to minimize security risks?

A Grant Lambda functions full administrative permissions to AWS resources for flexibility.

B Use environment variables to store sensitive data like API keys in Lambda functions.

C Limit Lambda function permissions to only what is necessary and validate all inputs carefully.

D Disable logging in Lambda functions to avoid exposing sensitive information.

💡 Hint

Think about the principle of least privilege and input validation.

Limiting permissions and validating inputs reduces the attack surface and prevents unauthorized access or injection attacks.

Practice

1. What is the main purpose of AWS Cognito in user authentication?

easy

A. To manage user sign-up and sign-in securely

B. To store application data in the cloud

C. To create virtual servers for applications

D. To monitor network traffic

Solution

1. Step 1: Understand AWS Cognito's role

   AWS Cognito is designed to handle user authentication, including sign-up and sign-in processes securely.

2. Step 2: Compare options with Cognito's function

   Options A, B, and D describe other AWS services or functions unrelated to user authentication.

3. Final Answer:

   To manage user sign-up and sign-in securely -> Option A

4. Quick Check:

   Cognito = User sign-up/sign-in management [OK]

Hint: Remember: Cognito = user login management [OK]

Common Mistakes:

• Confusing Cognito with storage services
• Thinking Cognito manages servers
• Mixing Cognito with network monitoring

2. Which AWS Cognito component stores and verifies user information?

easy

A. Identity pool

B. User pool

C. Lambda function

D. API Gateway

Solution

1. Step 1: Identify the component for user data

   User pools in Cognito are designed to store and verify user information like usernames and passwords.

2. Step 2: Eliminate unrelated components

   Identity pools provide temporary AWS credentials, Lambda runs code, and API Gateway manages APIs, none store user info.

3. Final Answer:

   User pool -> Option B

4. Quick Check:

   User pool = stores user info [OK]

Hint: User pool = user info storage and verification [OK]

Common Mistakes:

• Confusing identity pool with user pool
• Thinking Lambda stores user data
• Mixing API Gateway with user management

3. Given this AWS CLI command:
aws cognito-idp create-user-pool-client --user-pool-id us-east-1_123456789 --client-name MyAppClient
What does this command do?

medium

A. Lists all user pools

B. Creates a new user pool

C. Deletes a user pool client

D. Creates a new user pool client for an existing user pool

Solution

1. Step 1: Analyze the command action

   The command uses 'create-user-pool-client' which creates a client app for an existing user pool identified by --user-pool-id.

2. Step 2: Understand the client role

   User pool clients connect apps to user pools for login; this command does not create or delete user pools themselves.

3. Final Answer:

   Creates a new user pool client for an existing user pool -> Option D

4. Quick Check:

   create-user-pool-client = new client for user pool [OK]

Hint: Look for 'create-user-pool-client' to identify client creation [OK]

Common Mistakes:

• Confusing client creation with user pool creation
• Assuming deletion instead of creation
• Misreading the command as a list operation

4. You wrote this code snippet to authenticate a user with Cognito but get an error:

client = boto3.client('cognito-idp')
response = client.initiate_auth(
    ClientId='abc123',
    AuthFlow='USER_PASSWORD_AUTH',
    AuthParameters={'USERNAME': 'user1'}
)

What is missing to fix the error?

medium

A. Add 'PASSWORD' in AuthParameters

B. Change AuthFlow to 'ADMIN_NO_SRP_AUTH'

C. Remove ClientId parameter

D. Add 'SECRET_HASH' in AuthParameters

Solution

1. Step 1: Check required AuthParameters for USER_PASSWORD_AUTH

   This flow requires both 'USERNAME' and 'PASSWORD' parameters to authenticate.

2. Step 2: Identify missing parameter

   The code only provides 'USERNAME' but misses 'PASSWORD', causing the error.

3. Final Answer:

   Add 'PASSWORD' in AuthParameters -> Option A

4. Quick Check:

   USER_PASSWORD_AUTH needs USERNAME and PASSWORD [OK]

Hint: USER_PASSWORD_AUTH needs both username and password [OK]

Common Mistakes:

• Forgetting to include password in parameters
• Changing AuthFlow unnecessarily
• Removing ClientId which is required

5. You want to allow users to sign in with social providers like Google using AWS Cognito. Which setup is required?

hard

A. Use only an identity pool without a user pool

B. Create only a user pool client without identity providers

C. Configure a user pool with identity providers and set up an identity pool for AWS credentials

D. Set up Lambda triggers to handle social login manually

Solution

1. Step 1: Understand social login with Cognito

   Social login requires configuring user pools with external identity providers like Google.

2. Step 2: Connect user pool to identity pool for AWS credentials

   Identity pools provide AWS credentials after authentication; both are needed for full setup.

3. Final Answer:

   Configure a user pool with identity providers and set up an identity pool for AWS credentials -> Option C

4. Quick Check:

   Social login = user pool + identity pool setup [OK]

Hint: Social login needs user pool + identity pool configured [OK]

Common Mistakes:

• Skipping identity providers in user pool
• Using only identity pool without user pool
• Trying to handle social login only with Lambda