Examkin

Question

Difficulty: MediumApplication Authentication and Authorization with Amazon Cognito

A developer is building a serverless web application where users authenticate using an Amazon Cognito User Pool. The backend REST API is hosted on Amazon API Gateway with an AWS Lambda integration. The developer wants to restrict access to the `/premium-features` endpoint so that only users who belong to the 'PremiumGroup' in the User Pool can access it. Which approach implements this access control with the least latency and administrative effort?

  1. Configure the API Gateway method to use an Amazon Cognito User Pool Authorizer. In the backend Lambda function, check the cognito:groups claim in the request context to verify membership before returning the premium content.Answer
  2. B
    Create a custom API Gateway Lambda Authorizer that intercepts the ID token, calls the Amazon Cognito service provider API to retrieve the user's group membership, and dynamically generates an IAM policy.
  3. C
    Configure an Amazon Cognito Identity Pool to exchange the ID token for temporary AWS credentials mapped to the PremiumGroup role. Configure the API Gateway method to use AWS_IAM authorization, and pass the raw ID token in the Authorization header.
  4. D
    Configure the API Gateway method to use a Cognito User Pool Authorizer. Update the API Gateway execution role's IAM trust policy to explicitly allow the role associated with the PremiumGroup to invoke the Lambda function.

Answer

Configure the API Gateway method to use an Amazon Cognito User Pool Authorizer. In the backend Lambda function, check the cognito:groups claim in the request context to verify membership before returning the premium content.
The correct solution uses an Amazon Cognito User Pool Authorizer on API Gateway. When a user authenticates, Cognito issues a JWT (ID or Access token) containing claims about the user, including group membership in the cognito:groups claim. API Gateway automatically validates the token and passes these claims to the backend Lambda integration in the event object. The Lambda function can then inspect the cognito:groups claim to enforce group-based authorization. This approach requires no external database queries or additional API calls, minimizing execution latency.

Step-by-Step Solution

1
Integrate API Gateway with the Cognito User Pool.
API Gateway automatically validates the incoming JSON Web Token (JWT) sent by the client.
This offloads token validation from the application code and utilizes built-in AWS functionality.
2
Verify group membership inside the backend Lambda integration.
The Lambda function receives the decoded JWT claims in the request context (under the authorizer object) and inspects the cognito:groups claim.
Since the group information is already present in the JWT, checking it in the Lambda function avoids making external network calls to Cognito, keeping latency low.

Key Concept

API Gateway Cognito User Pool Authorizer integration and JWT claims evaluation
Estimated Time:1m 30s
Rate this question

Topics

Application Authentication and Authorization with Amazon Cognito

More questions from this topic