Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

An organization is designing a B2B integration platform where partner companies consume API endpoints exposed via an Amazon API Gateway REST API. The partners authenticate using a third-party Identity Provider (IdP) and obtain a custom JWT containing a partnerId claim. The organization requires that partners can only access API paths matching /partners/{partnerId}/*. Which solution should a developer implement to meet these authorization requirements with the least administrative complexity?

  1. Implement an API Gateway Lambda authorizer. In the authorizer function, validate the custom JWT and verify the signature using the Identity Provider's public keys. Extract the partnerId claim and return an IAM policy to API Gateway that grants execute-api:Invoke permissions exclusively on the resource path corresponding to /partners/{partnerId}/*.Answer
  2. B
    Configure an Amazon Cognito User Pool authorizer on the REST API. Define a custom attribute for the user pool to store the partnerId. Configure API Gateway Method Request validation to match the partnerId claim from the Cognito authorizer with the path parameter before invoking the backend integration.
  3. C
    Federate the external Identity Provider with an Amazon Cognito Identity Pool. Exchange the custom JWT for temporary AWS credentials. Have the partner applications sign their API requests using AWS Signature Version 4, and configure the REST API methods to use the built-in Cognito User Pool authorizer.
  4. D
    Implement an API Gateway Lambda authorizer in request mode. Pass the custom JWT to a Lambda Proxy Integration. In the backend Lambda function, extract the partnerId from the request context and write a resource policy attached to the API Gateway API to dynamically restrict access to the /partners/{partnerId}/* path.

Answer

Implement an API Gateway Lambda authorizer to validate the JWT and dynamically generate an IAM policy that allows access only to /partners/{partnerId}/*.
The correct solution involves deploying a Lambda authorizer. The Lambda authorizer receives the token, validates its signature against the IdP's JWKS (JSON Web Key Set), extracts the partnerId claim, and dynamically constructs an IAM policy. This IAM policy grants execute-api:Invoke permission specifically on the ARN pattern arn:aws:execute-api:region:account-id:api-id/stage/GET/partners/{partnerId}/*, enforcing least-privilege access control at the API Gateway boundary.

Step-by-Step Solution

1
Determine if Cognito User Pool Authorizer can validate external JWTs directly.
It cannot, as Cognito User Pool authorizers are designed for Amazon Cognito User Pools.
Identifies that a Lambda authorizer or Cognito federation is required.
2
Analyze how to enforce path-based access control based on JWT claims dynamically.
A Lambda authorizer can extract the partnerId claim and return a dynamically generated IAM policy.
Enforces least privilege at the API Gateway layer before the backend is invoked.
3
Evaluate the configuration complexity of the proposed solutions.
Using a Lambda authorizer keeps the architecture simple by validating and authorizing in one step without Cognito Identity Pool federation.
Selects the solution with the least operational overhead.

Key Concept

API Gateway Lambda Authorizer with Dynamic Policy Generation
Estimated Time:2m 0s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic