Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A company is developing a REST API in Amazon API Gateway that will serve a partner dashboard. The dashboard authenticates users through a third-party OpenID Connect (OIDC) identity provider. The developer needs to secure the API Gateway endpoints so that only users containing the PartnerAdmin role within their OIDC token can access the /partner/settings resource. To optimize performance and reduce backend overhead, the system must cache the authorization decisions for up to 10 minutes. Which two configuration steps should the developer perform to meet these requirements?

  1. Create an API Gateway Lambda authorizer that validates the OIDC JSON Web Token (JWT), verifies the presence of the PartnerAdmin role within the claims, and returns an IAM policy allowing execute-api:Invoke on the resource ARN.Answer
  2. Enable authorizer caching in the API Gateway authorizer configuration, set the TTL to 600 seconds, and specify the client's identity source header as the cache key.Answer
  3. C
    Create an Amazon Cognito User Pool authorizer in API Gateway, configure the Issuer URI to match the third-party OIDC provider, and filter incoming requests using a custom gateway policy mapping.
  4. D
    Configure the API Gateway resource to use standard IAM authorization, and implement token validation and role-checking logic directly within the backend Lambda proxy integration function.
  5. E
    Create an Amazon Cognito Identity Pool authorizer in API Gateway, link the third-party OIDC identity provider, and configure the authorizer to validate the JWT.

Answer

Create an API Gateway Lambda authorizer that validates the OIDC JWT token and returns an IAM policy allowing access to the resource, and enable authorizer caching with a TTL of 600 seconds utilizing the identity source header as the cache key.
The correct configurations involve creating a Lambda authorizer to decode and validate the third-party OIDC JWT token, verify the custom claims, and return an IAM policy allowing access. To meet the performance requirement, authorizer caching must be configured on the authorizer with a 600-second TTL using the identity source header (such as the Authorization header) as the cache key.

Step-by-Step Solution

1
Determine the token issuer and auth type
Identify that the token is issued by a third-party OIDC provider, which rules out Amazon Cognito User Pool authorizers since they only natively support Cognito User Pools.
Choosing the correct authorizer type is the first step to securing custom integrations.
2
Configure a Lambda authorizer
Create a Lambda authorizer that parses the JWT token, extracts the claims (specifically looking for the PartnerAdmin role), and returns an IAM policy allowing execute-api:Invoke on the target resource.
A Lambda authorizer is required to evaluate custom JWT claims and generate policy documents dynamically.
3
Configure caching in API Gateway
Enable authorizer caching with a TTL of 600 seconds, setting the identity source to the HTTP header containing the token (e.g., Authorization).
Caching avoids calling the Lambda authorizer on every incoming request, which minimizes overhead and latency.

Key Concept

API Gateway custom Lambda authorizers are used for validating third-party JWT tokens and dynamic policy generation, and authorization caching is used to decrease cost and latency.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic