2.1 - Authentication and secrets (Cognito, Secrets Manager)
AWS Certified Developer Associate objective 2.1 covers application authentication and secret storage. A database password or API credential should be stored in AWS Secrets Manager, which encrypts it and can rotate it automatically, rather than in code or plaintext config. Amazon Cognito handles user sign-in: a user pool authenticates users and issues JWT tokens, and a REST API on API Gateway validates those tokens by attaching a Cognito user pool authorizer to the method. When a mobile app authenticated by a user pool then needs temporary AWS credentials to call services directly, a Cognito identity pool exchanges the token for scoped, temporary IAM credentials. You should also know Parameter Store SecureString and STS. Expect scenario questions that describe storing a secret, authenticating users, validating tokens at the API, or granting AWS access to app users, and ask which service or Cognito component applies.
Store DB password/credentials = Secrets Manager (auto-rotate). Authenticate users + issue JWTs = Cognito user pool. Validate those JWTs at API Gateway = user pool authorizer. Exchange token for temporary AWS creds = Cognito identity pool.
Practice questions
1. Where should an application store a database password so it is encrypted and can be rotated automatically?
- In the application's source code
- In AWS Secrets Manager (correct answer)
- In a plaintext file on the instance
- In a public S3 bucket
Secrets Manager stores secrets encrypted with KMS and can rotate them automatically, retrieved at runtime via the SDK. Hard-coding or plaintext files expose credentials.
2. An API must let external users sign up, sign in, and receive JWT tokens with minimal custom code. Which service provides this?
- Individual AWS IAM users for each person
- AWS Directory Service for Microsoft AD
- Amazon Inspector vulnerability scans
- Amazon Cognito user pools (correct answer)
Cognito user pools provide a managed user directory with sign-up/sign-in, MFA, and issue JWT tokens (ID/access) that API Gateway can validate. IAM users are for AWS account access, not app end users.
3. How can a developer grant an application temporary, time-limited access to upload a single object to a private S3 bucket?
- Make the bucket public for one hour
- Generate a pre-signed S3 URL (correct answer)
- Share the IAM user's password
- Attach the object to an email
A pre-signed URL, created with the requester's credentials, grants time-limited permission for a specific operation (e.g., PUT one object) without making the bucket public.
4. A browser app on example.com is blocked calling an API Gateway endpoint on another domain. What must be enabled on the API?
- A larger Lambda timeout on the integration
- AWS WAF managed rule groups
- Server-side encryption on responses
- CORS (Cross-Origin Resource Sharing) (correct answer)
Browsers block cross-origin calls unless the API returns proper CORS headers (Access-Control-Allow-Origin, etc.). Enabling CORS on API Gateway adds these, including the preflight OPTIONS response.
5. A developer needs cross-account access to assume a role in another AWS account temporarily. Which action provides the temporary credentials?
- iam:CreateUser in the target account
- kms:GenerateDataKey on a shared key
- sts:AssumeRole on the target role (correct answer)
- s3:PutObject with a bucket policy
sts:AssumeRole returns temporary security credentials (access key, secret, session token) for the target role, provided the role's trust policy allows the caller. This is the standard cross-account access pattern.
6. A mobile app authenticates users with a Cognito user pool and now needs temporary AWS credentials to call S3 directly. What provides those credentials?
- Embedding an IAM access key in the app
- A Cognito identity pool exchanging the token (correct answer)
- The user pool app client secret shared to the app
- A public S3 bucket policy for all users
A Cognito identity pool (federated identities) exchanges a user pool (or third-party) token for temporary, limited AWS credentials via STS, mapped to an IAM role. User pools authenticate; identity pools authorize AWS access.