Examkin

Question

Difficulty: Very hardAPI Gateway Security and Authorization

A developer is designing a serverless multi-tenant SaaS application. The frontend client sends requests to an Amazon API Gateway REST API backed by AWS Lambda. The application uses an external OpenID Connect (OIDC) identity provider for user authentication. The API must validate the signature and expiration of the incoming JSON Web Token (JWT). In addition, access to specific resource paths and HTTP methods must be dynamically controlled based on the user's tenant ID and user role claims embedded in the JWT. The backend Lambda function needs to receive these validated claims to perform tenant-specific business logic without re-decoding or re-validating the token. Which solution meets these requirements with the lowest latency and follows security best practices?

  1. Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.Answer
  2. B
    Configure a Cognito User Pools Authorizer on API Gateway and federate the external OIDC identity provider with the user pool. In the backend Lambda function, extract the JWT from the authorization header, manually decode it, and validate its signature. Use custom code in the backend Lambda function to enforce path-based authorization and log tenant activity.
  3. C
    Configure a Cognito Identity Pool and integrate the external OIDC identity provider. Have the client exchange the OIDC JWT for temporary AWS credentials using the Cognito Identity Pool, configure the API Gateway API to use IAM Authorization, and parse the OIDC JWT inside the backend Lambda function to retrieve the tenant ID and user role for logging.
  4. D
    Create a Lambda Token Authorizer in API Gateway to validate the JWT. In the authorizer function, return an IAM policy allowing access. Since the Lambda Proxy Integration does not support forwarding custom authorizer metadata directly, configure a custom integration mapping template to extract the JWT claims from the header and map them to a custom JSON payload sent to the backend Lambda function.

Answer

Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.
The correct solution uses a Lambda Request Authorizer to perform custom validation of an external OIDC token and dynamically generate an IAM policy based on the claims (tenant ID and user role) extracted from the token. By returning these claims in the context object of the authorizer's response, API Gateway automatically passes them to the backend Lambda function via the requestContext.authorizer property of the proxy integration event. This keeps latency low, prevents the backend from having to parse or validate the token again, and enforces authorization at the API Gateway layer.

Step-by-Step Solution

1
Select the appropriate API Gateway authorizer type for external OIDC JWT validation and dynamic routing/authorization policy generation.
A Lambda Request Authorizer is selected because it receives request details (path, method, headers) along with the token, allowing it to perform custom OIDC JWT signature validation and dynamically generate a fine-grained IAM policy.
Cognito User Pools authorizers cannot dynamically generate customized IAM policies based on custom claims for arbitrary external OIDC tokens directly, and Cognito Identity Pools add unnecessary latency by requiring a token-to-credential exchange.
2
Design the Lambda Authorizer logic to validate the JWT and extract claims.
The Lambda Authorizer validates the JWT signature against the external IdP's JWKS endpoint and verifies the claims.
Validation must occur at the API Gateway level to reject unauthorized traffic before it reaches the backend, saving cost and minimizing latency.
3
Generate the IAM policy and the context map in the authorizer response.
The authorizer returns an IAM Policy allowing/denying access to specific method ARNs based on user role and tenant, along with a custom context map containing the user's tenant ID and role.
API Gateway uses the returned IAM policy to authorize the request and passes the context map to the backend integration.
4
Forward the claims to the backend Lambda function via Lambda Proxy Integration.
The backend Lambda function accesses the context properties directly via the requestContext.authorizer event path (e.g., event.requestContext.authorizer.tenantId).
This eliminates the need for custom mapping templates or decoding the token again in the backend Lambda function.

Key Concept

API Gateway Lambda Authorizers with custom context propagation
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic