Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is configuring security for an Amazon API Gateway REST API that serves a client web portal. The portal users authenticate using an external, non-AWS identity provider that issues JSON Web Tokens (JWT). The developer wants to validate these tokens at the API Gateway boundary before requests are forwarded to a backend integration. Which API Gateway authorization method should the developer use to validate the tokens with the least operational complexity?

  1. Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.Answer
  2. B
    Configure an Amazon Cognito User Pool authorizer to validate the third-party JWT directly at the API Gateway level.
  3. C
    Configure an Amazon Cognito Identity Pool authorizer to validate the JWT and generate temporary AWS credentials to sign the request.
  4. D
    Configure a Lambda proxy integration and perform token validation inside the backend integration Lambda function.

Answer

Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.
Configuring a Lambda authorizer allows API Gateway to call a custom Lambda function to validate bearer tokens (like JWTs) issued by any third-party identity provider. The function verifies the token signature against the provider's public keys and returns an IAM policy to allow or deny the request, securing the API at the boundary.

Step-by-Step Solution

1
Analyze the token source and type.
The token is a JSON Web Token (JWT) issued by an external, non-AWS identity provider.
Understanding the token source determines which native and custom integration options are compatible.
2
Evaluate native API Gateway authorizers.
Amazon Cognito User Pool authorizers cannot directly validate external JWTs without a Cognito User Pool wrapping them, and IAM authorization requires Signature Version 4 signatures.
This rules out native authorizers that require specific token issuers or request signing mechanisms.
3
Select the correct custom authorization method.
A Lambda authorizer (custom authorizer) is the appropriate choice as it runs custom code to validate external JWTs and return the required IAM policy.
Using a Lambda authorizer enforces security validation at the API Gateway boundary rather than letting unauthorized traffic reach backend integrations.

Key Concept

API Gateway Lambda Authorizers for external identity providers
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic