How to Authenticate External Users Across ECS Microservices?
HOTSPOT
A company is building a web application that needs to authenticate external users across multiple microservices that the company hosts on Amazon Elastic Container Service (Amazon ECS). The solution must use temporary credentials and minimize the management overhead required to maintain user databases.
Select and order the correct steps from the following list to implement a secure authentication strategy that meets these requirements. Select each step one time or not at all.
Configure Amazon Cognito user pools for user authentication.
Set up an IAM role for each microservice. Grant each role appropriate permissions.
Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices.
Create an Amazon DynamoDB table to store user credentials for each microservice.
Create an Amazon Cognito application client to interact with the web application.
Set up AWS IAM Identity Center to give users access to the microservices.
Community Insight
Tests whether you recognize Cognito-issued temporary tokens validated at API Gateway as the external-user authentication chain, not DynamoDB user tables or workforce IAM Identity Center.
The SCS-C03 hotspot asks you to order the Cognito user pool, Cognito app client, and API Gateway Lambda authorizer steps that authenticate external users across ECS microservices. The answer uses short-lived Cognito tokens and avoids any custom user-credential database.
Including an IAM role per microservice or a DynamoDB credentials table in the user-login sequence; the former grants AWS permissions to workloads, and the latter recreates the user database the requirement says to avoid.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Amazon Cognito user pools are the managed external-user identity store and issue short-lived tokens, satisfying the temporary-credential and low-overhead requirements. The app client is the configuration that lets the web application call the user pool for sign-up and sign-in. API Gateway HTTP API with a Lambda authorizer then validates the Cognito token before forwarding requests to the ECS microservices, so each microservice does not need its own user database or direct login logic. This three-step order—user pool, app client, authorizer—matches the stated comment that there are "Los 3 pasos correctos, en orden."Why Other Candidate Answers Are Wrong
A DynamoDB table for user credentials violates the minimize-user-database requirement and duplicates Cognito's managed authentication. IAM Identity Center is designed for workforce access to AWS accounts and applications, not external customer authentication for a public web app. An IAM role per microservice is a valid ECS task-permissions control, but it authorizes the service to call AWS APIs; it does not authenticate external users, so it is not one of the ordered user-login steps. That leaves the three Cognito/API Gateway steps as the only coherent sequence.Community Comment Notes
Bugatti1 flagged this as one of the few questions actually seen on the exam, which suggests the scenario wording should be read literally rather than over-engineered. The Spanish-speaking commenter summarized "Los 3 pasos correctos, en orden" and began the sequence with Cognito user pools followed by the Cognito application client. Those notes align with treating the DynamoDB, IAM Identity Center, and per-microservice IAM role options as distractors for this specific user-authentication question.Official Reference
Exam Strategy
Map every option to one of the stated requirements: external users point to Cognito user pools, web-app integration points to an app client, and token enforcement points to API Gateway Lambda authorizers. If an option creates a user store or grants AWS service permissions, exclude it from the ordered authentication flow.
Frequently Asked Questions
Why isn't the per-microservice IAM role part of the ordered Cognito/API Gateway steps?
IAM task roles give ECS microservices temporary AWS permissions, but they do not authenticate external web users. The question's ordered flow is specifically the user-login and token-validation chain.
Does the API Gateway Lambda authorizer replace Amazon Cognito user pools?
No; Cognito user pools authenticate users and issue tokens, while the Lambda authorizer validates those tokens at API Gateway before requests reach the ECS microservices.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →