Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A company is building a multi-tenant REST API using Amazon API Gateway. The API must validate incoming calls from clients using a custom JSON Web Token (JWT) sent in the X-Custom-Auth header. The token validation requires checking the token's signature against a public key, verifying that the tenant_id claim matches a list of active tenants, and dynamically generating an IAM policy to restrict access to only the tenant's specific resources. The authorization decision needs to be cached for 300 seconds to optimize performance. Which solution should a developer implement to meet these requirements?

  1. Create a Lambda authorizer of type REQUEST. Configure method.request.header.X-Custom-Auth as the identity source. In the Lambda function, validate the JWT, extract the tenant_id claim, construct an IAM policy targeting the tenant's specific resource path, and return the policy.Answer
  2. B
    Configure an Amazon Cognito User Pool authorizer. Set the token source header to X-Custom-Auth. Configure a Cognito post-authentication Lambda trigger to validate the JWT signature, extract the tenant_id claim, and dynamically generate the required IAM policy for API Gateway.
  3. C
    Configure a Cognito Identity Pool to authenticate clients using the custom JWT. Enable AWS_IAM authorization on the API Gateway methods. Instruct clients to exchange their JWT for temporary AWS credentials and sign their API Gateway requests using Signature Version 4 (SigV4).
  4. D
    Configure a Lambda Proxy integration to pass the X-Custom-Auth header directly to the backend Lambda function. In the backend Lambda function, validate the JWT, extract the tenant_id claim, and use the AWS Security Token Service (STS) to dynamically apply the generated IAM policy to the current execution context.

Answer

Create a Lambda authorizer of type REQUEST. Configure method.request.header.X-Custom-Auth as the identity source. In the Lambda function, validate the JWT, extract the tenant_id claim, construct an IAM policy targeting the tenant's specific resource path, and return the policy.
The correct solution uses a REQUEST-type Lambda authorizer. By defining the identity source as `method.request.header.X-Custom-Auth`, API Gateway can cache the generated IAM policy for 300 seconds. The Lambda authorizer executes code to validate the third-party JWT, check the tenant_id claim, and return a custom IAM policy that limits access to only the tenant's specific API paths, complying with least-privilege security principles.

Step-by-Step Solution

1
Determine the appropriate authorization mechanism.
Since custom JWT verification, claim validation (tenant_id), and dynamic IAM policy generation are required, a built-in Cognito User Pool authorizer cannot be used. A Lambda authorizer is required.
Only Lambda authorizers allow running custom code to validate third-party tokens and output dynamically generated IAM policies.
2
Select the Lambda authorizer type and identity source.
Use a REQUEST-type Lambda authorizer with `method.request.header.X-Custom-Auth` configured as the identity source.
A REQUEST authorizer provides access to request headers, query parameters, and stage variables. Defining the header as the identity source allows API Gateway to cache the authorization policy for the specified 300-second TTL.
3
Implement validation and least-privilege IAM policy generation in the Lambda function.
The Lambda function verifies the signature of the token from X-Custom-Auth, decodes the payload, validates the tenant_id claim, and returns an IAM policy allowing access only to `arn:aws:execute-api:region:account-id:api-id/stage/method/tenant-resource/*`.
This guarantees security boundaries between tenants and adheres to the IAM principle of least privilege.

Key Concept

API Gateway Lambda Authorizer with Token Caching and Scoped IAM Policies
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic