Examkin

Question

Difficulty: EasyAPI Development and Integration with Amazon API Gateway

A developer is designing a REST API using Amazon API Gateway. The API must restrict access to authenticated users who log in using an Amazon Cognito user pool. The developer wants to validate the JSON Web Tokens (JWTs) sent in the request authorization header with the minimum amount of custom code and maintenance overhead. Which of the following is the most appropriate method to authorize these requests?

  1. A
    Create a custom Lambda authorizer that decodes and verifies the signatures of the Cognito tokens using an external library.
  2. Configure a built-in Amazon Cognito user pool authorizer in API Gateway to validate the incoming tokens.Answer
  3. C
    Configure an Amazon Cognito identity pool authorizer in API Gateway to validate the user pool tokens.
  4. D
    Enable API Gateway Lambda proxy integration and write custom token verification logic in the backend Lambda function.

Answer

Configure a built-in Amazon Cognito user pool authorizer in API Gateway to validate the incoming tokens.
Configuring a built-in Amazon Cognito user pool authorizer allows API Gateway to natively decode and validate JSON Web Tokens (JWTs) provided by Cognito User Pools. This approach is highly efficient, requires no custom code, and rejects unauthorized requests before invoking any backend integrations.

Step-by-Step Solution

1
Identify the key authorization requirement: validating tokens from an Amazon Cognito user pool in API Gateway REST API with minimal custom code.
The solution must use built-in configuration rather than custom code.
This minimizes the developer's maintenance overhead and development time.
2
Evaluate the native integration options of API Gateway with Amazon Cognito.
API Gateway REST APIs support a built-in Cognito user pool authorizer.
This authorizer validates the JWT signatures automatically at the API Gateway layer.
3
Contrast built-in options with custom Lambda authorizers or backend validation.
Custom Lambda authorizers or backend Lambda validation require custom code and trigger execution billing, whereas Cognito user pool authorizers are zero-code configurations.
Selecting the built-in option aligns with AWS best practices for simplicity and efficiency.

Key Concept

API Gateway built-in Cognito User Pool Authorizers
Rate this question

Topics

API Development and Integration with Amazon API Gateway

More questions from this topic