A developer is securing a REST API in Amazon API Gateway. Users authenticate against an Amazon Cognito User Pool. The developer wants API Gateway to automatically validate the incoming JSON Web Tokens (JWT) before forwarding requests to the backend, with the least operational overhead.
Which two steps must the developer perform to configure this security setup? (Select TWO.)
- Create a Cognito User Pool authorizer in API Gateway and configure it with the user pool details.Answer
- Configure the API Gateway method authorization to use the newly created Cognito User Pool authorizer.Answer
- CCreate a Cognito Identity Pool to issue temporary IAM credentials for signing requests using Signature Version 4.
- DCreate a custom Lambda authorizer to manually decode and validate the signature of the Cognito JSON Web Token.
- EConfigure a Lambda custom integration mapping template to parse authorization headers and validate JWT signatures.
Answer
Create a Cognito User Pool authorizer in API Gateway and configure the API Gateway method authorization to use it.
The correct options represent the standard path for native JWT validation with Cognito. Creating a Cognito User Pool authorizer leverages built-in functionality to automatically validate signatures, expiration, and audience of identity tokens. Configuring the API Gateway method to use this authorizer ensures the validation checks are applied to incoming requests.
Step-by-Step Solution
Key Concept
API Gateway Cognito User Pool Authorizers