How to Authenticate External Users Across ECS Microservices?
Short answer
Configure Cognito user pools, create an app client for the web app, then add an API Gateway HTTP API Lambda authorizer to validate tokens before forwarding to the ECS microservices.
Question
A company is building a web application that needs to authenticate external users across multiple microservices that the company hosts on Amazon Elastic Container Service (Amazon ECS). The solution must use temporary credentials and minimize the management overhead required to maintain user databases.
Select and order the correct steps from the following list to implement a secure authentication strategy that meets these requirements. Select each step one time or not at all.
Configure Amazon Cognito user pools for user authentication.
Set up an IAM role for each microservice. Grant each role appropriate permissions.
Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices.
Create an Amazon DynamoDB table to store user credentials for each microservice.
Create an Amazon Cognito application client to interact with the web application.
Set up AWS IAM Identity Center to give users access to the microservices.
Key Takeaways
Tests whether you recognize Cognito-issued temporary tokens validated at API Gateway as the external-user authentication chain, not DynamoDB user tables or workforce IAM Identity Center.
The SCS-C03 hotspot asks you to order the Cognito user pool, Cognito app client, and API Gateway Lambda authorizer steps that authenticate external users across ECS microservices. The answer uses short-lived Cognito tokens and avoids any custom user-credential database.
Common mistake: Including an IAM role per microservice or a DynamoDB credentials table in the user-login sequence; the former grants AWS permissions to workloads, and the latter recreates the user database the requirement says to avoid.
Expert Analysis
Why the Answer Is Correct
Amazon Cognito user pools are the managed external-user identity store and issue short-lived tokens, satisfying the temporary-credential and low-overhead requirements. The app client is the configuration that lets the web application call the user pool for sign-up and sign-in. API Gateway HTTP API with a Lambda authorizer then validates the Cognito token before forwarding requests to the ECS microservices, so each microservice does not need its own user database or direct login logic. This three-step order—user pool, app client, authorizer—matches the stated comment that there are "Los 3 pasos correctos, en orden."
Why Other Candidate Answers Are Wrong
A DynamoDB table for user credentials violates the minimize-user-database requirement and duplicates Cognito's managed authentication. IAM Identity Center is designed for workforce access to AWS accounts and applications, not external customer authentication for a public web app. An IAM role per microservice is a valid ECS task-permissions control, but it authorizes the service to call AWS APIs; it does not authenticate external users, so it is not one of the ordered user-login steps. That leaves the three Cognito/API Gateway steps as the only coherent sequence.
Community Comment Notes
Bugatti1 flagged this as one of the few questions actually seen on the exam, which suggests the scenario wording should be read literally rather than over-engineered. The Spanish-speaking commenter summarized "Los 3 pasos correctos, en orden" and began the sequence with Cognito user pools followed by the Cognito application client. Those notes align with treating the DynamoDB, IAM Identity Center, and per-microservice IAM role options as distractors for this specific user-authentication question.
Official Reference
- https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools.html
- https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-client-apps.html
- https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html
These links open the official vendor documentation in a new tab.
Exam Strategy
Map every option to one of the stated requirements: external users point to Cognito user pools, web-app integration points to an app client, and token enforcement points to API Gateway Lambda authorizers. If an option creates a user store or grants AWS service permissions, exclude it from the ordered authentication flow.
Frequently Asked Questions
Why isn't the per-microservice IAM role part of the ordered Cognito/API Gateway steps?
Does the API Gateway Lambda authorizer replace Amazon Cognito user pools?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
Bugatti1 👍 3This was probably one of the few questions in here that was on the test…..
-
7f6aef3 👍 1Los 3 pasos correctos, en orden Configure Amazon Cognito user pools for user authentication. Crea el user pool que autentica a los usuarios externos y emite tokens temporales, sin que tengas que mantener tu propia base de datos. Create an Amazon Cognito application client to interact with the web application. El app client permite que la aplicación web se comunique con el user pool (flujos de login, obtención de tokens). Implement an Amazon API Gateway HTTP API with AWS Lambda authorizers to validate tokens before forwarding requests to microservices. Los tokens de Cognito se validan en la puerta de entrada (API Gateway + Lambda authorizer) antes de reenviar las solicitudes a los microservicios en ECS.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →