Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is building a mobile application where users authenticate via Amazon Cognito. The backend services are exposed through an Amazon API Gateway REST API. The developer needs to restrict access to the API endpoints so that only successfully authenticated users from a specific Amazon Cognito User Pool can call the API. The mobile client sends the id_token in the Authorization header. Which configuration represents the most operationally efficient and secure solution?

  1. Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.Answer
  2. B
    Create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from the Cognito User Pool, validates the signature of the incoming token, and returns an IAM policy.
  3. C
    Configure an API Gateway Cognito Authorizer pointing to an Amazon Cognito Identity Pool, mapping the token to temporary AWS credentials to authorize the requests.
  4. D
    Configure a Lambda Proxy Integration for the API methods, and implement custom code within the backend Lambda function to inspect the Authorization header and validate the token.

Answer

Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.
The correct answer configures a native API Gateway Cognito Authorizer referencing the User Pool. This approach allows API Gateway to automatically and natively validate token signatures, audiences, and expiration, offloading the security checks from the backend application code and saving operational costs.

Step-by-Step Solution

1
Identify the authentication source and token format.
Amazon Cognito User Pool id_token (JWT).
Knowing that users authenticate via User Pools and produce standard JWTs helps choose the appropriate native integration.
2
Select the API Gateway authorization type that natively handles Cognito JWT verification.
API Gateway Cognito Authorizer.
A Cognito Authorizer allows API Gateway to directly validate token signatures, expiration, and audiences without invoking custom code or Lambda functions.
3
Configure the token source in API Gateway.
Set token source to the 'Authorization' header.
This instructs API Gateway to extract the id_token from the Authorization header of the incoming HTTP request.

Key Concept

API Gateway Cognito Authorizer
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic