Exam AWS Certified Developer Associate topic 1 question 332 discussion

B. Create an authentication action for the listener rules of the ALB. Set the rule action type to authenticate-cognito. Set the OnUnauthenticatedRequest field to "deny." To ensure that all requests to an internet-facing Application Load Balancer (ALB) are authenticated through Amazon Cognito, the developer can create an authentication action for the listener rules of the ALB. The authentication action specifies the type of authentication to be performed, which in this case should be "authenticate-cognito." Additionally, the developer should set the OnUnauthenticatedRequest field to "deny," which will cause the ALB to reject any requests that are not authenticated. This will ensure that only requests with a valid Amazon Cognito token will be allowed through the ALB. Other options, such as adding a listener rule to return a fixed response, creating an Amazon API Gateway API, or creating a new target group with a Lambda function target, are not necessary for the given requirements.

https://docs.aws.amazon.com/elasticloadbalancing/latest/APIReference/API_AuthenticateOidcActionConfig.html

B To ensure that every request to the API is authenticated through Amazon Cognito, the developer should create an authentication action for the listener rules of the ALB and set the rule action type to authenticate-cognito. The OnUnauthenticatedRequest field should be set to "deny." This will force the ALB to check for a valid authentication token from Amazon Cognito before forwarding the request to the target group. Option B is the correct answer.

It's c for me.

There's no need to create an API GW. ALB can handle it itself: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html You configure user authentication by creating an authenticate action for one or more listener rules. The authenticate-cognito and authenticate-oidc action types are supported only with HTTPS listeners. For descriptions of the corresponding fields, see AuthenticateCognitoActionConfig and AuthenticateOidcActionConfig in the Elastic Load Balancing API Reference version 2015-12-01.

Control access to a REST API using Amazon Cognito user pools as authorizer: To use an Amazon Cognito user pool with your API, you must first create an authorizer of the COGNITO_USER_POOLS type and then configure an API method to use that authorizer. https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html

CCCCCCC

B https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html#rule-action-types

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-enable-cognito-user-pool.html