Examkin

Question

Difficulty: EasyAPI Gateway Security and Authorization

An online learning platform uses Amazon API Gateway to expose a REST API that delivers course catalog data. The platform needs to restrict access to this API so that only users who have registered and authenticated through the platform's Amazon Cognito User Pool can retrieve the catalog. The development team wants to implement this security control with the minimum amount of custom code and operational overhead.

Which configuration should the developer implement to secure the REST API?

  1. Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.Answer
  2. B
    Configure an API Gateway Lambda authorizer that calls Cognito Identity Pools to obtain temporary AWS credentials for each user request.
  3. C
    Deploy an API Gateway Lambda authorizer that validates the Cognito JWT token by downloading the JSON Web Key Set (JWKS) and programmatically verifying the signature.
  4. D
    Enable Lambda Proxy Integration on the API Gateway resource and write custom JWT verification logic inside the backend Lambda function.

Answer

Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.
The correct option is the one that configures a native Cognito User Pools authorizer. Amazon API Gateway has built-in integration to validate JSON Web Tokens (JWTs) generated by Amazon Cognito User Pools. This native feature requires zero custom code, provides automatic validation, and handles unauthorized requests at the API Gateway layer before invoking any backend integration, meeting all requirements with the lowest operational overhead.

Step-by-Step Solution

1
Identify the authentication provider and the requirement for authorization.
The users authenticate using an Amazon Cognito User Pool.
Knowing that users are in a Cognito User Pool helps choose between Cognito-native authorizers and custom authorizers.
2
Determine the implementation option with the lowest operational overhead and custom code.
API Gateway has a built-in 'Cognito User Pools authorizer' which natively validates Cognito tokens.
Using native integration eliminates the need to write, deploy, or maintain custom code in a Lambda function.
3
Configure the method execution in API Gateway to use the authorizer.
The REST API methods are secured using the Cognito User Pools authorizer.
This configuration validates the token at the edge before requests reach any backend integration.

Key Concept

API Gateway Cognito User Pools Authorizer
Estimated Time:1m 0s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic