Cognito

Question 1

Cognito is used when

Answer 1

we want to give our users an identity so they can interact with our servers and our application.

Question 2

Cognito is different products

Answer 2

1. Cognito User Pools
2. Cognito Identity Pools (Federated Identity)
3. Cognito Sync

Question 3

Cognito User Pools

Answer 3

• sign in functionality for app users

Question 4

Cognito Identity Pools (Federated Identity Pools)

Answer 4

• provide AWS credentials to users so they can access AWS resources directly
• provide direct access to our AWS environment from the client side.
• integrate with Cognito User Pools as an identity provider

Question 5

Cognito Sync

Answer 5

synchronize data from device to Cognito
probably deprecated and replaced by AppSync. But still on exam
AppSync is currently out of scope for the exam,

Question 6

Cognito User Pools - what can you do

Answer 6

• create a serverless database of users for your mobile apps.
• simple login: username or email and pwd
• possibility to verify emails, phone numbers and add MFA
• can enable Federated Identiites (Facebook, Google, SAML)
• sends back a JSON Web Token, can be used to verify
  the identity of someone. So can be integrated with API Gateway for authentication

Question 7

Cognito User Pools -how

Answer 7

1. We have our app and it wants to authenticate to CUP.
2. It’s going to register our login using a password,
3. CUP, after verifying the login, says, “Okay here is a JWT or JSON Web Token.”

Question 8

Cognito Identity Pools (Federated Identity Pools) how

Answer 8

1. we log into a Federated Identity Provider, or we can choose to remain anonymous.
2. And, from this we get temporary AWS credentials
   back from the Federated Identity Pool.
3. And, then these credentials come with an IAM policy attached to it, and so we can do stuff based on this IAM policy.

Question 9

Cognito Identity Pools (Federated Identity Pools) use case

Answer 9

we wanted to provide temporary access to write to an S3 bucket using a Facebook login.

Question 10

Cognito Identity Pools (Federated Identity Pools) how internally

Answer 10

1. our app is able to login to an identity provider. The identity provider can be whatever you want. It an be Google, Facebook, Twitter, SAML, OpenID. And, even the Cognito User Pools
2. from there our app gets to login and gets a token.
3. using this token, we are going to pass it on to our Federated Identity Pool.
4. we authenticate using that token to our FIP, and it will verify the token with our identity provider just to make sure we are who we say we are.
5. Once the token has been verified, the Federated Identity will talk to the STS service to get temporary credentials for AWS.
6. Once it has that, it will pass on the temporary credentials back to our application, and now that our application has these temporary AWS credentials,
   it is, for example, able to interact directly with our S3 bucket. we have an IAM policy which allows us to do certain things and not do other things.

Question 11

Cognito Sync lets you

Answer 11

store user preferences, configuration, and the state of our application, and it has a cross device synchronization capability.

Any platform, could be iOS, Android, etc. You can do offline stuff.

So, if you were to change your preferences offline and then you go back online, then they’re synchronized automatically.

Question 12

Cognito Sync - to have it working well,

Answer 12

you need to use Federate Identity Pools in Cognito not User Pools.

The data is stored in data sets, and each data set could be up to one megabyte, and we can have up to 20 data sets to synchronize.

Question 13

SAM

Answer 13

Serverless Application Model

framework for developing and deploying serverless applications

is going to be done in YAML code.

Question 14

through SAM you can configure

Answer 14

your Lambda functions, your DynamoDB tables, your API Gateway, your Cognito User Pools,
and SAM will help you deploy that automatically to the AWS Cloud

SAM allows you to quickly deploy your Lambda functions using the integration with Code Deploy.

Question 15

SAM locally

Answer 15

SAM can help you run your Lambda functions, your API Gateway, and your DynamoDB tables locally on your computer so you can do some debugging.

Question 16

You would like to provide a Facebook login before your users call your API hosted by API Gateway. You need seamlessly authentication integration, you will use

Answer 16

Cognito User Pools directly integration with Facebook Logins