Amazon Cognito User Pools for API Gateway Authentication

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Configure an Amazon Cognito user pool for user authentication and implement Amazon API Gateway REST APIs with a Cognito authorizer.

Question

An analytics company uses Amazon VPC to run its multi-tier services. The company wants to use RESTful APIs to offer a web analytics service to millions of users. Users must be verified by using an authentication service to access the APIs. Which solution will meet these requirements with the MOST operational efficiency?
  1. Configure an Amazon Cognito user pool for user authentication. Implement Amazon API Gateway REST APIs with a Cognito authorizer. Correct Answer
  2. Configure an Amazon Cognito identity pool for user authentication. Implement Amazon API Gateway HTTP APIs with a Cognito authorizer.
  3. Configure an AWS Lambda function to handle user authentication. Implement Amazon API Gateway REST APIs with a Lambda authorizer.
  4. Configure an IAM user to handle user authentication. Implement Amazon API Gateway HTTP APIs with an IAM authorizer.

Key Takeaways

The core concept is distinguishing between authentication (User Pools) and authorization/access to AWS resources (Identity Pools), with managed authorizers providing superior operational efficiency over custom Lambda functions.

This question addresses the most operationally efficient way to authenticate users for RESTful APIs using Amazon Cognito User Pools and API Gateway.

Common mistake: Candidates often confuse Identity Pools with User Pools or choose Lambda Authorizers, failing to recognize that User Pools are specifically designed for sign-in management and that managed integrations reduce operational overhead.

Expert Analysis

Why the Answer Is Correct

Option A is correct because Amazon Cognito User Pools are explicitly designed for user authentication and identity management. When integrated with API Gateway's built-in Cognito Authorizer, this setup provides a highly scalable, managed solution that eliminates the need to write and maintain custom code for handling user sign-ins and token validation. This directly meets the requirement for "most operational efficiency" by leveraging fully managed services.

Why the Other Options Are Wrong

Option B is incorrect because Identity Pools (Federated Identities) are used for granting temporary AWS credentials to access AWS services, not for authenticating end-users for application access. Option C involves a Lambda Authorizer, which requires managing serverless code, handling cold starts, and maintaining the logic, resulting in higher operational overhead compared to the native Cognito integration. Option D suggests using IAM users for web app authentication, which is an anti-pattern due to the complexity of credential management and security risks associated with long-lived static credentials.

Community Comment Notes

The community consensus strongly supports Option A. As noted by user 'stephensimudemy', "User pools is for Authentication and user management," highlighting the primary function of the service. Another commenter, 'sandordini', clarified the distinction: "Identity pools are for authorization... User pools are for authentication." While one user argued for HTTP APIs (Option B), they overlooked the fundamental error of using Identity Pools for authentication, reinforcing why A is the only valid choice among the options provided.

Official Reference

https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-assigning-roles.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for keywords like "operational efficiency" when choosing between managed services and custom code; managed integrations (like API Gateway + Cognito Authorizer) typically win over Lambda-based solutions unless complex custom logic is strictly required.

Frequently Asked Questions

Why not use Identity Pools for user authentication?

Identity Pools provide temporary AWS credentials for accessing AWS services, whereas User Pools handle user registration and sign-in for applications.

Is Lambda Authorizer less efficient than Cognito Authorizer?

Yes, Lambda Authorizers require managing code and incur cold start latency, making them more operationally intensive than the native Cognito integration.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. stephensimudemy 👍 7 Answered A
    User pools is for Authentication and user management
  2. sandordini 👍 6 Answered A
    User pools are for authentication. Your app users can sign in through the user pool, Identity pools are for authorization, give them access to other AWS services.
  3. [Removed] 👍 3 Answered A
    user pool vs identity pool: https://repost.aws/knowledge-center/cognito-user-pools-identity-pools
  4. NayeraB 👍 2 Answered B
    B offers more operational efficiency imo
  5. zdi561 👍 1 Answered A
    When comparing operation efficiency, a Cognito authorizer in AWS API Gateway is generally considered more performant than a Lambda authorizer for basic authentication checks, as Cognito is a managed service optimized for user authentication, while a Lambda authorizer introduces an additional layer of processing with potential cold start overhead, making it better suited for complex, custom authorization logic. But Lambda is more flexible
Show 2 more comments
  1. Andy_09 👍 5
    Option A
  2. chefKC 👍 2
    Answer is A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide