Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is designing a serverless mobile application that integrates with a REST API hosted on Amazon API Gateway. Users must be able to register and sign in directly through the mobile application. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them, while minimizing custom code and operational costs.

Which two actions should the developer take to meet these requirements? (Select TWO.)

  1. Configure an Amazon Cognito User Pool authorizer in Amazon API Gateway and associate it with the API methods.Answer
  2. Configure the mobile application to send the Cognito ID token in the Authorization header of the HTTP requests.Answer
  3. C
    Create a custom Lambda authorizer in Amazon API Gateway that decodes and validates the Cognito JSON Web Token (JWT) signature.
  4. D
    Create an Amazon Cognito Identity Pool to exchange the Cognito User Pool token for temporary AWS credentials, and configure IAM authorization on the API methods.
  5. E
    Apply an API Gateway resource policy that explicitly allows requests where the principal matches the Amazon Cognito User Pool ARN.

Answer

The developer should configure an Amazon Cognito User Pool authorizer in Amazon API Gateway, associate it with the API methods, and configure the mobile application to send the Cognito ID token in the Authorization header of the HTTP requests.
The correct options are configuring a built-in Cognito User Pool authorizer in API Gateway and passing the ID token in the Authorization header. This natively offloads JWT verification to API Gateway without custom code, minimizing cost. The API Gateway Cognito authorizer validates the signature, audience, and expiration of the ID token passed in the Authorization header.

Step-by-Step Solution

1
Identify the native mechanism in Amazon API Gateway to authorize requests using Amazon Cognito User Pools.
Determine that the Amazon API Gateway Cognito User Pool authorizer provides built-in integration to validate user authentication tokens without custom code.
Using the native authorizer minimizes both the operational cost of running a custom Lambda function and the development effort of writing token validation logic.
2
Determine how the mobile application should pass the authentication state to API Gateway.
Configure the mobile application to extract the ID token (JWT) returned upon successful authentication with Cognito and place it in the HTTP Authorization header of subsequent API calls.
The API Gateway Cognito authorizer reads the incoming token from the designated header to verify its signature and expiration.

Key Concept

Amazon API Gateway integrates natively with Amazon Cognito User Pools using a built-in authorizer. This allows developers to validate JSON Web Tokens (JWTs) generated by Cognito without writing custom Lambda functions. The client application passes the Cognito ID token in the request header, and API Gateway automatically validates it before forwarding the request to downstream services.
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic