Cognito for user authentication in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a new Cognito User Pool with a name.

AWS

resource "aws_cognito_user_pool" "[1]" {
  name = "MyUserPool"
}

Drag options to blanks, or click blank then click option'

Apool1

Buserpool

Cmy_user_pool

Dcognito_pool

Attempts:

3 left

💡 Hint

Common Mistakes

Using spaces or invalid characters in the resource name.

Using a name that is too generic or unclear.

The resource name must be a valid identifier. "my_user_pool" is a clear and valid name for the Cognito User Pool resource.

2fill in blank

medium

Complete the code to enable email as a sign-in alias in the Cognito User Pool.

AWS

resource "aws_cognito_user_pool" "my_user_pool" {
  name = "MyUserPool"
  [1] = ["email"]
}

Drag options to blanks, or click blank then click option'

Ausername_attributes

Balias_attributes

Csign_in_aliases

Dlogin_attributes

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'username_attributes' which configures username requirements instead of aliases.

Using 'sign_in_aliases' which is not recognized by AWS Cognito.

The correct attribute to enable email as a sign-in alias is alias_attributes. This allows users to sign in using their email address.

3fill in blank

hard

Fix the error in the code to set password policy minimum length to 8.

AWS

resource "aws_cognito_user_pool" "my_user_pool" {
  name = "MyUserPool"
  password_policy {
    minimum_length = [1]
  }
}

Drag options to blanks, or click blank then click option'

Aminimum_length

B"8"

Ceight

D8

Attempts:

3 left

💡 Hint

Common Mistakes

Putting the number inside quotes, making it a string.

Using a word instead of a number.

The minimum_length must be a number, not a string. So, use 8 without quotes.

4fill in blank

hard

Fill both blanks to configure MFA to be optional and enable SMS as a second factor.

AWS

resource "aws_cognito_user_pool" "my_user_pool" {
  name = "MyUserPool"
  mfa_configuration = "[1]"
  sms_configuration {
    [2] = "arn:aws:iam::123456789012:role/SMSRole"
  }
}

Drag options to blanks, or click blank then click option'

AOPTIONAL

BREQUIRED

Csns_caller_arn

Dsms_role_arn

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'REQUIRED' when the task asks for optional MFA.

Using 'sms_role_arn' which is not the correct key.

Setting mfa_configuration to OPTIONAL allows users to choose MFA. The correct key for the SMS role ARN is sns_caller_arn.

5fill in blank

hard

Fill all three blanks to create a user pool client with no secret and enable refresh token validity for 30 days.

AWS

resource "aws_cognito_user_pool_client" "my_user_pool_client" {
  name         = "MyUserPoolClient"
  user_pool_id = aws_cognito_user_pool.my_user_pool.id
  [1] = false
  refresh_token_validity = [2]
  token_validity_units {
    refresh_token = "[3]"
  }
}

Drag options to blanks, or click blank then click option'

Agenerate_secret

B30

Cdays

Dsecret_enabled

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'secret_enabled' which is not a valid attribute.

Setting refresh_token_validity as a string instead of a number.

Using 'day' instead of 'days' for the unit.

The correct attribute to disable client secret generation is generate_secret. The refresh token validity is set to 30, and the unit is 'days'.

Practice

1. What is the main purpose of AWS Cognito in user authentication?

easy

A. To manage user sign-up and sign-in securely

B. To store application data in the cloud

C. To create virtual servers for applications

D. To monitor network traffic

Solution

1. Step 1: Understand AWS Cognito's role

   AWS Cognito is designed to handle user authentication, including sign-up and sign-in processes securely.

2. Step 2: Compare options with Cognito's function

   Options A, B, and D describe other AWS services or functions unrelated to user authentication.

3. Final Answer:

   To manage user sign-up and sign-in securely -> Option A

4. Quick Check:

   Cognito = User sign-up/sign-in management [OK]

Hint: Remember: Cognito = user login management [OK]

Common Mistakes:

• Confusing Cognito with storage services
• Thinking Cognito manages servers
• Mixing Cognito with network monitoring

2. Which AWS Cognito component stores and verifies user information?

easy

A. Identity pool

B. User pool

C. Lambda function

D. API Gateway

Solution

1. Step 1: Identify the component for user data

   User pools in Cognito are designed to store and verify user information like usernames and passwords.

2. Step 2: Eliminate unrelated components

   Identity pools provide temporary AWS credentials, Lambda runs code, and API Gateway manages APIs, none store user info.

3. Final Answer:

   User pool -> Option B

4. Quick Check:

   User pool = stores user info [OK]

Hint: User pool = user info storage and verification [OK]

Common Mistakes:

• Confusing identity pool with user pool
• Thinking Lambda stores user data
• Mixing API Gateway with user management

3. Given this AWS CLI command:
aws cognito-idp create-user-pool-client --user-pool-id us-east-1_123456789 --client-name MyAppClient
What does this command do?

medium

A. Lists all user pools

B. Creates a new user pool

C. Deletes a user pool client

D. Creates a new user pool client for an existing user pool

Solution

1. Step 1: Analyze the command action

   The command uses 'create-user-pool-client' which creates a client app for an existing user pool identified by --user-pool-id.

2. Step 2: Understand the client role

   User pool clients connect apps to user pools for login; this command does not create or delete user pools themselves.

3. Final Answer:

   Creates a new user pool client for an existing user pool -> Option D

4. Quick Check:

   create-user-pool-client = new client for user pool [OK]

Hint: Look for 'create-user-pool-client' to identify client creation [OK]

Common Mistakes:

• Confusing client creation with user pool creation
• Assuming deletion instead of creation
• Misreading the command as a list operation

4. You wrote this code snippet to authenticate a user with Cognito but get an error:

client = boto3.client('cognito-idp')
response = client.initiate_auth(
    ClientId='abc123',
    AuthFlow='USER_PASSWORD_AUTH',
    AuthParameters={'USERNAME': 'user1'}
)

What is missing to fix the error?

medium

A. Add 'PASSWORD' in AuthParameters

B. Change AuthFlow to 'ADMIN_NO_SRP_AUTH'

C. Remove ClientId parameter

D. Add 'SECRET_HASH' in AuthParameters

Solution

1. Step 1: Check required AuthParameters for USER_PASSWORD_AUTH

   This flow requires both 'USERNAME' and 'PASSWORD' parameters to authenticate.

2. Step 2: Identify missing parameter

   The code only provides 'USERNAME' but misses 'PASSWORD', causing the error.

3. Final Answer:

   Add 'PASSWORD' in AuthParameters -> Option A

4. Quick Check:

   USER_PASSWORD_AUTH needs USERNAME and PASSWORD [OK]

Hint: USER_PASSWORD_AUTH needs both username and password [OK]

Common Mistakes:

• Forgetting to include password in parameters
• Changing AuthFlow unnecessarily
• Removing ClientId which is required

5. You want to allow users to sign in with social providers like Google using AWS Cognito. Which setup is required?

hard

A. Use only an identity pool without a user pool

B. Create only a user pool client without identity providers

C. Configure a user pool with identity providers and set up an identity pool for AWS credentials

D. Set up Lambda triggers to handle social login manually

Solution

1. Step 1: Understand social login with Cognito

   Social login requires configuring user pools with external identity providers like Google.

2. Step 2: Connect user pool to identity pool for AWS credentials

   Identity pools provide AWS credentials after authentication; both are needed for full setup.

3. Final Answer:

   Configure a user pool with identity providers and set up an identity pool for AWS credentials -> Option C

4. Quick Check:

   Social login = user pool + identity pool setup [OK]

Hint: Social login needs user pool + identity pool configured [OK]

Common Mistakes:

• Skipping identity providers in user pool
• Using only identity pool without user pool
• Trying to handle social login only with Lambda