Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is building a web application that allows users to sign in using Amazon Cognito. The backend REST API is hosted on Amazon API Gateway. The developer needs to secure the API so that only authenticated users can access the resources. The solution must minimize code maintenance, overhead, and latency. Which configuration should the developer implement to meet these requirements?

  1. A
    Create a custom Lambda authorizer that validates the Amazon Cognito JSON Web Token (JWT) by fetching the public JSON Web Key Set (JWKS) from the user pool.
  2. Configure an Amazon Cognito User Pool authorizer on the API Gateway methods and pass the Cognito identity token in the request header.Answer
  3. C
    Integrate an Amazon Cognito Identity Pool with API Gateway using IAM authorization, and sign all incoming client requests using Signature Version 4.
  4. D
    Configure a Lambda proxy integration on the API methods and implement custom token validation logic inside the backend Lambda function.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway methods and pass the Cognito identity token in the request header.
Configuring an Amazon Cognito User Pool authorizer allows API Gateway to automatically validate the incoming identity token without requiring custom Lambda code. This minimizes latency, development effort, and execution costs compared to custom authorizers.

Step-by-Step Solution

1
Analyze the requirements for securing the API Gateway REST API.
The requirement specifies validating user credentials from Amazon Cognito with minimal code maintenance, overhead, and latency.
This helps narrow down the choices between built-in API Gateway features and custom authorization code.
2
Compare built-in API Gateway features with custom-coded solutions.
Amazon API Gateway offers a built-in Amazon Cognito User Pool authorizer that validates JWT tokens natively without invoking any custom Lambda functions.
Using native features reduces both execution latency and the overhead of maintaining custom code.
3
Evaluate and eliminate incorrect authorization configurations.
Custom Lambda authorizers add custom code; Cognito Identity Pools (IAM auth) require request signing and are designed for AWS resource authorization; validating tokens inside a Lambda proxy integration mixes authentication with backend business logic and incurs extra runtime costs.
This identifies the built-in Cognito User Pool authorizer as the most efficient and standard solution.

Key Concept

API Gateway built-in Cognito User Pool Authorizers provide native, low-latency validation of JSON Web Tokens (JWT) without writing or managing custom backend code.
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic