Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

An internal employee portal has a frontend application that retrieves account data by calling a REST API hosted on Amazon API Gateway. The employees are authenticated using an Amazon Cognito User Pool. The developer wants to secure the API Gateway endpoints so that only authenticated users can access the resources. The developer needs to validate the JSON Web Tokens (JWT) at the API Gateway level with the least operational overhead.

Which configuration should the developer implement to meet these requirements?

  1. A
    Configure a Lambda Proxy integration in API Gateway and validate the JWT token using custom integration mapping templates.
  2. B
    Implement a custom AWS Lambda authorizer that retrieves the public JSON Web Key Set from Cognito to validate the JWT signature.
  3. Create a Cognito User Pools authorizer in API Gateway and configure the API method to use this authorizer.Answer
  4. D
    Configure an API Gateway authorizer that integrates with an Amazon Cognito Identity Pool to validate the employee JWT tokens.

Answer

Create a Cognito User Pools authorizer in API Gateway and configure the API method to use this authorizer.
The correct option is to create a Cognito User Pools authorizer in API Gateway and configure the API method to use it. This utilizes API Gateway's native capability to validate JWT tokens generated by Amazon Cognito User Pools without writing any custom code, satisfying the requirement for the least operational overhead.

Step-by-Step Solution

1
Identify the authentication source and the validation requirement.
The authentication source is an Amazon Cognito User Pool which generates JSON Web Tokens (JWTs). Validation must occur at the API Gateway layer.
Understanding the source and location of authentication determines the available integration types.
2
Evaluate the requirement for least operational overhead and least custom code.
API Gateway offers a built-in authorizer specifically designed for Cognito User Pools that handles JWT validation natively.
Choosing the native authorizer eliminates the need to write and maintain custom validation functions.
3
Configure the API Gateway method.
Create the Cognito User Pools authorizer in API Gateway and associate it with the HTTP methods of the API.
This secures the API endpoints by ensuring that only valid Cognito JWTs are allowed to pass through to the backend.

Key Concept

API Gateway Cognito User Pools Authorizer
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic