Securing Applications with Bearer Tokens

This guide explores the implementation of bearer tokens for securing applications, focusing on Amazon Cognito, API Gateway, and the AWS Security Token Service (STS) as defined in the DVA-C02 curriculum.

Learning Objectives

After studying this guide, you should be able to:

• Define the role and structure of a bearer token in web security.
• Differentiate between Amazon Cognito User Pools and Identity Pools.
• Configure an API Gateway Authorizer to validate incoming tokens.
• Explain how AWS STS generates temporary security credentials via AssumeRole operations.
• Implement the standard workflow for authenticating users and authorizing resource access.

Key Terms & Glossary

• Bearer Token: A security token that grants access to whoever "bears" it, without requiring further identification. Most commonly implemented as a JSON Web Token (JWT).
• JWT (JSON Web Token): A compact, URL-safe means of representing claims to be transferred between two parties.
• IdP (Identity Provider): A service that creates, maintains, and manages identity information (e.g., Amazon Cognito, Google, Facebook).
• OIDC (OpenID Connect): An authentication layer on top of the OAuth 2.0 protocol.
• STS (Security Token Service): A global AWS service that provides temporary, limited-privilege credentials for users.

The "Big Idea"

The fundamental shift in modern application security is moving away from static, long-lived credentials (like username/password or IAM Access Keys) toward dynamic, short-lived tokens. By using bearer tokens, applications minimize the "blast radius" of a compromised credential, as tokens automatically expire and are scoped to specific tasks. In the AWS ecosystem, Amazon Cognito acts as the broker that handles this complexity, allowing developers to focus on features rather than identity infrastructure.

Formula / Concept Box

Hierarchical Outline

1. Identity Federation & Cognito
   • User Pools: Manage user directories; issue ID, Access, and Refresh tokens.
   • Identity Pools: Exchange tokens for temporary AWS credentials.
2. Securing the API Layer
   • API Gateway Authorizers: Validate JWTs against Cognito User Pools.
   • Lambda Authorizers: Custom logic for token validation.
3. Credential Management
   • AWS STS: The backend engine for AssumeRole and GetSessionToken requests.
   • Temporary Credentials: Comprised of Access Key ID, Secret Access Key, and a Security Token.

Visual Anchors

Authentication and Authorization Flow

JWT Visual Structure

Definition-Example Pairs

• ID Token: A token that contains claims about the identity of the authenticated user (e.g., name, email).
  • Example: A mobile app displaying the user's profile picture and name in the header after they log in via Cognito.
• Access Token: A token used specifically to authorize access to an API or resource.
  • Example: Sending an Access Token in the Authorization header to a /get-orders endpoint in API Gateway to prove the user has permission to view data.
• Refresh Token: A long-lived token used to obtain new ID or Access tokens without re-prompting the user for credentials.
  • Example: A banking app that keeps you logged in for 30 days but requires a fresh Access Token every 60 minutes for security.

Worked Examples

Scenario: Configuring a Cognito Authorizer in API Gateway

Goal: Secure a REST API so only users in a specific Cognito User Pool can invoke it.

1. Step 1: Create the Authorizer

   • In the API Gateway Console, navigate to Authorizers.
   • Select Create New Authorizer.
   • Type: Cognito.
   • Cognito User Pool: Select your specific pool (e.g., ProdUsers).
   • Token Source: method.request.header.Authorization.

2. Step 2: Apply to a Method

   • Navigate to Resources > select a method (e.g., GET).
   • Under Method Request, set Authorization to the new Cognito Authorizer.

3. Step 3: Client Request

   • The client must now include the token:
   bashCopy

   curl -H "Authorization: Bearer <YOUR_JWT_HERE>" https://api-id.execute-api.region.amazonaws.com/prod/resource

Checkpoint Questions

1. What happens to an API request if the bearer token is sent 1 second after its exp (expiration) claim time?
2. Which Cognito component is required if your application needs to upload files directly to an S3 bucket?
3. True or False: A bearer token is considered a form of "something you know" (like a password).
4. What is the name of the AWS service that converts a Cognito Token into temporary IAM credentials?

▶Click to see answers

1. The request will be denied (401 Unauthorized) because the token is no longer valid.
2. Amazon Cognito Identity Pools (to exchange tokens for temporary IAM credentials).
3. False. It is "something you have" (or "bear").
4. AWS Security Token Service (STS).