Examkin

Question

Difficulty: MediumAPI Development and Integration with Amazon API Gateway

A developer is designing a REST API in Amazon API Gateway that must secure access to its endpoints using an existing Amazon Cognito User Pool. The developer wants to validate the JSON Web Tokens (JWTs) passed in the `Authorization` header of client requests with the minimum amount of custom code and lowest latency. Which configuration should the developer implement in API Gateway?

  1. Configure a Cognito User Pool authorizer on the API Gateway methods and set the Token Source to 'Authorization'Answer
  2. B
    Create a custom Lambda token authorizer that performs cryptographic validation of the Cognito JWT and returns an IAM policy
  3. C
    Implement a Lambda proxy integration and write application logic in the backend function to inspect the proxy event headers for token verification
  4. D
    Configure an IAM authorizer on API Gateway and write a custom Lambda authorizer to map User Pool tokens to IAM policies

Answer

Configure a Cognito User Pool authorizer on the API Gateway methods and set the Token Source to 'Authorization'
The native Cognito User Pool authorizer in Amazon API Gateway validates the JWT signatures from Cognito User Pools directly at the gateway layer. This requires no custom code, is easy to set up, and avoids the cold-start latency and execution costs of a Lambda function.

Step-by-Step Solution

1
Identify the authentication source and requirements
The client sends a JWT from Amazon Cognito User Pool in the 'Authorization' header, and the goal is validation with minimal code and latency.
This establishes that we need to inspect the header and compare it with the Cognito User Pool keys.
2
Evaluate API Gateway's built-in capabilities vs custom solutions
API Gateway provides a native 'Cognito User Pool Authorizer' that validates JWTs automatically without invoking Lambda functions.
Choosing a native feature eliminates code maintenance (minimizes custom code) and reduces execution overhead (minimizes latency).
3
Configure the token source mapping
Map the token source field to 'Authorization' so API Gateway knows which incoming header contains the JWT.
API Gateway requires this mapping to extract the token for verification.

Key Concept

API Gateway Cognito User Pool Authorizer
Rate this question

Topics

API Development and Integration with Amazon API Gateway

More questions from this topic