Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is designing a security architecture for a corporate mobile application that accesses backend microservices through an Amazon API Gateway REST API. The application requirements specify that all API requests must be secured using AWS Signature Version 4 (SigV4) signing, and users must obtain temporary AWS IAM credentials after authenticating with a third-party Identity Provider (IdP). Which configuration should the developer implement to authorize these requests at the API Gateway level with the least administrative effort?

  1. Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).Answer
  2. B
    Configure the API Gateway methods to use a Cognito User Pool authorizer. Authenticate users through an Amazon Cognito user pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).
  3. C
    Configure a Lambda authorizer on the API Gateway REST API. Write custom validation logic inside the authorizer function to verify the third-party IdP token, generate temporary AWS credentials, and return them to the client to sign requests using Signature Version 4 (SigV4).
  4. D
    Configure the API Gateway REST API with Lambda proxy integration. Validate the third-party IdP token directly in the backend Lambda function, request temporary AWS credentials using AWS Security Token Service (STS), and return them in the API response headers to sign future requests.

Answer

Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).
Configuring API Gateway to use AWS_IAM authorization requires clients to sign their requests with AWS Signature Version 4 (SigV4). By integrating the third-party Identity Provider (IdP) with an Amazon Cognito identity pool (federated identities), the application can exchange the IdP authentication token for temporary, limited-privilege AWS credentials. The client can then use these credentials to sign the API requests, providing secure, native API Gateway authorization with minimal operational overhead.

Step-by-Step Solution

1
Enable AWS_IAM authorization on the API Gateway REST API resource methods.
API Gateway will reject any unsigned requests or requests not signed with valid AWS Signature Version 4 (SigV4) credentials.
To enforce SigV4 authentication at the API Gateway level, ensuring only authorized AWS identities can access the backend.
2
Set up an Amazon Cognito identity pool and configure the third-party Identity Provider (IdP) as an authentication provider.
Users authenticate with the IdP and obtain an ID token, which the application exchanges with the Cognito identity pool for temporary AWS IAM credentials.
To map external federated identities to temporary AWS IAM credentials for the client application.
3
Sign the API Gateway HTTP requests using the retrieved temporary AWS IAM credentials in the client application.
The client successfully sends SigV4-signed requests that API Gateway validates against the IAM permissions associated with the Cognito identity pool's authenticated role.
To complete the SigV4 handshake and securely access the authorized API Gateway endpoints.

Key Concept

API Gateway AWS_IAM authorization secures endpoints by requiring clients to sign requests with AWS Signature Version 4 (SigV4) credentials. Combining this with Cognito Identity Pools allows external authenticated identities to obtain the temporary credentials needed for SigV4 signing.
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic