Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A media streaming company is designing a new REST API using Amazon API Gateway to serve premium video content metadata to web clients. Users log in using their corporate identities federated with an Amazon Cognito User Pool. The developer wants to restrict access to the API Gateway resources based on this authentication. The backend is implemented using AWS Lambda functions with custom integrations (non-proxy integration). The solution must validate tokens at the API Gateway boundary and pass the authenticated user's claims to the backend with minimal custom validation code. Which two steps should the developer perform to meet these requirements? (Select TWO.)

  1. A
    Create an Amazon Cognito Identity Pool, configure the API Gateway method to use AWS_IAM authorization, and sign the client requests with temporary credentials obtained from the identity pool.
  2. Configure a COGNITO_USER_POOLS authorizer on the API Gateway method, specify the Amazon Cognito User Pool ARN, and pass the token in the identity source header.Answer
  3. C
    Create a custom Lambda authorizer that invokes the Amazon Cognito identity provider API to validate the token on each request and return an IAM policy.
  4. Configure an API Gateway integration mapping template to extract the user claims from the $context.authorizer.claims variable and inject them into the request payload sent to the Lambda function.Answer
  5. E
    Configure the Lambda integration to use proxy integration, and write custom Python code inside the Lambda function to decode the authorization header and verify the signature.

Answer

Configure a COGNITO_USER_POOLS authorizer on the API Gateway method and use an API Gateway integration mapping template to map the $context.authorizer.claims variable to the Lambda function payload.
To secure the API with minimal overhead, a native Cognito User Pools authorizer must be configured. This authorizer validates JWTs at the API Gateway level before executing the backend. For Lambda custom integrations, mapping templates are required to forward claims (such as user profile and groups) stored in the $context.authorizer.claims context variable to the Lambda function input.

Step-by-Step Solution

1
Configure the API Gateway method authentication.
Create and configure a Cognito User Pools authorizer on the API Gateway method, pointing to the User Pool ARN, to handle JWT validation natively.
This offloads token validation to API Gateway natively, ensuring unauthorized requests are rejected at the edge with zero custom code.
2
Map the authorizer context to the backend.
Define an API Gateway integration mapping template for the request integration.
Since the backend uses a custom integration (non-proxy), mapping templates are required to extract claims from the authorizer context using $context.authorizer.claims and pass them as JSON fields to the Lambda function.

Key Concept

API Gateway provides native integration with Cognito User Pools via COGNITO_USER_POOLS authorizers, which validate JWTs without custom code. When using custom (non-proxy) integrations, mapping templates are required to forward authorizer claims from API Gateway to the backend Lambda function.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic