Examkin

Question

Difficulty: EasyAPI Gateway Security and Authorization

A developer is securing a feedback collection REST API hosted on Amazon API Gateway. The requirement is to allow access only to authenticated corporate users who reside in an Amazon Cognito User Pool. Which two steps should the developer perform to implement this authentication mechanism? (Select TWO).

  1. Create an Amazon API Gateway authorizer of type Cognito and select the Cognito User Pool.Answer
  2. Configure the API Gateway resource methods to use the Cognito authorizer.Answer
  3. C
    Configure an Amazon Cognito Identity Pool to authenticate requests and associate it directly with the API Gateway resource.
  4. D
    Write a custom AWS Lambda authorizer that manually decodes and validates the Cognito JSON Web Tokens (JWT).
  5. E
    Configure the API Gateway resource with a Lambda proxy integration to handle user pool authentication inside the backend integration code.

Answer

To secure the API using an Amazon Cognito User Pool, the developer must create a Cognito authorizer in API Gateway pointing to the User Pool, and then configure the API methods to use this authorizer.
To secure the API using an Amazon Cognito User Pool natively, the developer must first create an API Gateway authorizer of type Cognito, linking it directly to the User Pool. The developer then configures the relevant API resource methods to use this Cognito authorizer. This allows API Gateway to automatically authenticate incoming requests by validating the JWT passed in the Authorization header.

Step-by-Step Solution

1
Create a Cognito authorizer in Amazon API Gateway.
An authorizer configured to validate JSON Web Tokens (JWTs) issued by the specified Amazon Cognito User Pool is established.
This sets up the connection between API Gateway and the user directory where corporate users are managed.
2
Configure the HTTP method (e.g., GET, POST) on the API Gateway resource to use the newly created Cognito authorizer.
The API method is secured, requiring a valid Authorization header containing a JWT.
This enforces the authorizer check at the API Gateway edge before any request is forwarded to backend integrations.

Key Concept

API Gateway Cognito Authorizers
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic