SAP-C03 practice question: Application authentication and authorization (Cognito, Verified Permissions, EKS Pod Identity)
Security, Compliance, and Governance A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital group runs a patient portal with a web app and a mobile app. About two million patients sign in, and clinicians sign in through the same portal to view only the patients assigned to them.
The backend is an Amazon API Gateway API with services written by four teams. The rules for who may see which record must be defined once, reviewed by the compliance team, and changed without redeploying the services.
Which solution meets these requirements?
Choose one answer.
AA. Create a Cognito identity pool that gives every signed-in user one IAM role with read access to the patient table, and have each service check the assigned-clinician list in its own code.
BB. Use the API Gateway authorizer to check a shared API key that each app sends, and have each team hard-code the clinician-to-patient mapping in its Lambda functions.
CC. Use an Amazon Cognito user pool for sign-in and an API Gateway JWT authorizer for the tokens. Define the rules as Amazon Verified Permissions policies that each service queries for every record request.
DD. Store each clinician's list of patients in an IAM policy attached to a per-clinician IAM user, and let the mobile app call the API with that user's access keys.
Show the answer and explanation
Answer: C
A. Wrong: A shared role gives every user the same table access, and the rules then live in four services' code. The compliance team cannot review or change the rules in one place.
B. Wrong: An API key identifies an app and does not identify the user, so it cannot enforce per-patient access. Hard-coded mappings also need a redeploy for every change.
C. Right: Correct. The user pool handles sign-in and token issuance, and Verified Permissions holds one policy set that every service calls for authorization decisions. The compliance team can review and change the policies without redeploying the services.
D. Wrong: Patients and clinicians are not IAM users, and per-user access keys in a mobile app are a serious credential risk. This design also cannot scale to two million patients.
Explanation
Cognito handles sign-in and API Gateway checks the token, while Verified Permissions holds the per-record rules in one reviewable place. Shared roles, API keys and per-user IAM keys each leave the rules scattered or the authorization incorrect.
Want more on Application authentication and authorization (Cognito, Verified Permissions, EKS Pod Identity)? The 5 full-length practice sets have 6 more Application authentication and authorization (Cognito, Verified Permissions, EKS Pod Identity) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →