Examkin

Question

Difficulty: MediumAPI Development and Integration with Amazon API Gateway

A developer is building a serverless REST API using Amazon API Gateway and an AWS Lambda backend with Lambda proxy integration. The API will be accessed by a web application hosted on a different domain. The developer needs to secure the API using an existing Amazon Cognito User Pool and ensure that the web application can successfully make cross-origin requests. Which two actions should the developer take to meet these requirements? (Choose two.)

  1. Configure a Cognito User Pool authorizer in API Gateway and apply it to the API methods.Answer
  2. Enable CORS on the API Gateway resource to handle preflight OPTIONS requests, and program the Lambda function to include the Access-Control-Allow-Origin header in its response object.Answer
  3. C
    Create a custom Lambda authorizer that validates the client's credentials against the Cognito User Pool and returns an IAM policy.
  4. D
    Enable CORS in the API Gateway console for the resource, which automatically injects the Access-Control-Allow-Origin header into the response of the Lambda proxy integration.
  5. E
    Define an API Gateway integration response mapping template to inject the Access-Control-Allow-Origin header into the response payload received from the Lambda function.

Answer

To meet the requirements, the developer must configure a native Cognito User Pool authorizer in API Gateway to secure the API methods. To support CORS in a Lambda proxy integration, the developer must enable CORS on the API Gateway resource to handle preflight OPTIONS requests, and also ensure the backend Lambda function returns the Access-Control-Allow-Origin header in its JSON response object.
To secure the API with Cognito, the developer should configure a native Cognito User Pool authorizer, which natively validates JWTs without needing custom Lambda authorizer code. To allow cross-origin requests in a Lambda proxy integration, the developer must enable CORS on the resource to handle the OPTIONS preflight requests, and the Lambda function itself must return the Access-Control-Allow-Origin header, because API Gateway does not modify headers in proxy integrations.

Step-by-Step Solution

1
Configure the native Cognito User Pool authorizer under the API Gateway console, and associate it with the appropriate resource methods.
API Gateway automatically validates the Cognito JWT token passed in the Authorization header of client requests.
Using the built-in Cognito authorizer avoids custom Lambda authorizer overhead and code maintenance.
2
Enable CORS for the API resource in the API Gateway console.
An OPTIONS method is created with a mock integration to respond to preflight requests with CORS headers.
Browsers require a successful preflight response before making actual cross-origin requests.
3
Update the Lambda function's return payload to include the Access-Control-Allow-Origin header in the headers map.
The final response payload received by the client contains the CORS headers.
In a Lambda proxy integration, API Gateway passes the backend response directly to the client without modifying headers.

Key Concept

Configuring security authorization and cross-origin resource sharing (CORS) within Amazon API Gateway REST APIs using Lambda proxy integration.
Estimated Time:2m 0s
Rate this question

Topics

API Development and Integration with Amazon API Gateway

More questions from this topic