Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer at a financial technology company is designing a REST API using Amazon API Gateway. The API must validate custom bearer tokens generated by a legacy, proprietary on-premises authorization server. The validation process requires invoking a custom decryption library and checking a local revocation list. Once authorized, the backend Lambda function needs to receive the user's subscription tier, which is extracted during token validation, to return the appropriate level of data. Which two actions must the developer take to implement this security and integration flow? (Select TWO.)

  1. Implement an API Gateway Lambda authorizer that validates the custom bearer token and returns an IAM policy along with a context map containing the subscription tier.Answer
  2. Use Lambda proxy integration for the backend integration, and retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.Answer
  3. C
    Configure an Amazon Cognito User Pool authorizer and configure it to perform active verification against the on-premises revocation list.
  4. D
    Configure an Amazon Cognito Identity Pool to validate the legacy bearer tokens and pass the subscription tier as a session tag during the STS assume role call.
  5. E
    Configure a Lambda custom integration and write a custom mapping template that reads the bearer token from the header, runs a helper utility inside the template to validate the token, and injects the subscription tier into the payload.

Answer

Implement an API Gateway Lambda authorizer to validate the token and return the subscription tier in the context map, and use Lambda proxy integration to retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.
To authenticate legacy proprietary tokens requiring custom decryption and revocation checks, the developer must implement a Lambda authorizer. The Lambda authorizer validates the token and returns a JSON payload containing an IAM policy and a context map containing the user's subscription tier. When using Lambda proxy integration, API Gateway maps the context variables to the requestContext object, making them accessible in the backend Lambda function via the event structure under the authorizer property.

Step-by-Step Solution

1
Select the correct authorizer type.
Since the validation requires custom validation logic (decryption libraries and revocation checks), standard Cognito User Pool authorizers are not suitable. A Lambda authorizer must be configured.
Lambda authorizers execute a custom Lambda function to perform bearer token validation.
2
Pass context information from the authorizer.
The Lambda authorizer returns an IAM policy along with a key-value 'context' block containing the subscription tier.
The authorizer can inject string, number, or boolean values into the request context for downstream consumption.
3
Retrieve context in the backend integration.
By using Lambda proxy integration, the backend Lambda function receives the API Gateway request context containing the authorizer's context map directly in the event parameter under event.requestContext.authorizer.
This allows the backend function to dynamically adapt its behavior based on the subscription tier without re-validating the token.

Key Concept

Custom Lambda authorizers are used for validating non-Cognito tokens and passing custom context to backend integrations via the request context.
Estimated Time:2m 0s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic