Which authentication approach would meet these requirements with the LEAST amount of effort?

By:
In: DVA-C01
Tagged:
With: 2 Comments
A company has a web application in an Amazon Elastic Container Service (Amazon ECS) cluster running hundreds of secure services in AWS Fargate containers.The services are in target groups routed by an Application Load Balancer (ALB).Application users log in to the website anonymously, but they must be authenticated using any OpenID Connect protocol-compatible identity provider (IdP) to access the secure services.

Which authentication approach would meet these requirements with the LEAST amount of effort?

Configure the services to use Amazon Cognito.

Configure the ALB to use Amazon Cognito.

Configure the services to use AWS Security Token Service (AWS STS) with the OpenID Connect IdP.

Configure the Amazon ECS cluster to use AWS Security Token Service (AWS STS) with the OpenID Connect IdP.

Explanations:

Configuring the services to use Amazon Cognito would require integrating Cognito directly into each individual service, adding complexity.

Configuring the ALB to use Amazon Cognito allows for easy authentication with OpenID Connect-compatible IdPs, requiring minimal changes to services.

Configuring the services to use AWS STS with an OpenID Connect IdP would involve complex token management at the service level.

Configuring the ECS cluster to use AWS STS with an OpenID Connect IdP does not address the authentication requirement at the ALB level.

2026-03-27

2 Comments

  1. Elizabeth
    Author

    I sort that the answer is:
    Configure the ALB to use Amazon Cognito.

  2. Joseph
    Author

    To the best of my knowledge, the answer is:
    Configure the ALB to use Amazon Cognito.

Leave a Reply

Your email address will not be published. Required fields are marked *

twelve + 7 =