Examkin

Question

Difficulty: Very hardAPI Gateway Security and Authorization

A logistics company is exposing a shipment tracking API via an Amazon API Gateway REST API. The developer needs to secure the API to authenticate and authorize two categories of consumers:

1. Internal warehouse applications running on Amazon EC2 instances within the company's AWS account. These applications must be granted access using their IAM roles under the principle of least privilege.
2. Mobile client applications used by delivery drivers. These drivers authenticate against an external identity provider (IdP). The authorization process must validate custom claims in their security tokens to restrict access to specific geographical regions.

Which two configurations should the developer implement to secure the API Gateway endpoints for these consumers? (Select two.)

  1. Configure the API Gateway methods for the warehouse applications to use AWS_IAM authorization, and attach an IAM policy to the EC2 instances' instance profile role that allows the execute-api:Invoke action on the specific API resource ARN.Answer
  2. Configure a Lambda Request Authorizer for the delivery driver methods. In the authorizer Lambda function, validate the token from the external IdP, extract the custom geographic claim, and generate an IAM policy that allows access to the requested API resource.Answer
  3. C
    Configure a Cognito User Pools Authorizer for the delivery driver methods, and set up a Cognito Identity Pool to exchange the external IdP tokens for credentials to be validated by the authorizer.
  4. D
    Generate an API Gateway client certificate, associate it with the API Gateway stage, and install the certificate on the EC2 instances to authenticate client calls from the warehouse applications.
  5. E
    Configure the delivery driver methods to use Lambda Proxy Integration. In the backend Lambda function, validate the external IdP token, parse the geographic claims, and return an IAM policy with Effect: Allow inside the proxy integration response payload.

Answer

Configure the API Gateway methods for the warehouse applications to use AWS_IAM authorization, and configure a Lambda Request Authorizer for the delivery driver methods to validate the external IdP token and return an IAM policy.
The correct configurations involve using AWS_IAM authorization for the warehouse applications, combined with a Lambda Request Authorizer for the delivery drivers. AWS_IAM authorization natively validates requests signed using SigV4 from EC2 instance profiles. A Lambda Request Authorizer allows running custom authorization logic against an external identity provider's tokens and returning an IAM policy dynamically based on custom claims.

Step-by-Step Solution

1
Identify the authentication mechanism for internal AWS resources.
AWS_IAM authorization is identified as the native, secure mechanism.
Since the warehouse applications run on EC2 instances inside AWS, utilizing instance profiles and IAM roles with SigV4 signing avoids hardcoding credentials and provides fine-grained access control.
2
Determine the resource policy assignment for EC2.
Attach an IAM policy allowing execute-api:Invoke on the API's ARN to the EC2 instances' role.
The client role needs permission to call the API Gateway endpoint when AWS_IAM authorization is enabled.
3
Identify the authorization mechanism for external IdP users requiring custom claim validation.
A Lambda Request Authorizer is selected.
Because the identity provider is external and custom claims (geographical region) must be verified to grant access, a custom Lambda authorizer must validate the token and dynamically generate an IAM policy.
4
Verify that API Gateway client certificates and Cognito User Pools do not fit the direct requirements.
Reject Cognito User Pools and client certificates configurations.
Client certificates authenticate API Gateway to the backend, not the client to API Gateway. Cognito User Pools Authorizers cannot natively validate external IdP tokens with complex custom validation logic without a user directory interface.

Key Concept

API Gateway Security and Authorization mechanisms, specifically matching IAM authorization for AWS services and Lambda Authorizers for external custom token validation.
Estimated Time:3m 0s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic