Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is designing service-to-service communication between a microservice running on Amazon ECS in AWS Account A and a private REST API hosted on Amazon API Gateway in AWS Account B. The API Gateway endpoint must restrict access to only allow requests originating from the ECS microservice in Account A. The security architecture must adhere to the principle of least privilege and minimize custom code development. Which of the following configurations should the developer implement to meet these requirements?

  1. Configure the API Gateway method to use AWS_IAM authorization. Apply a resource policy to the API Gateway REST API in Account B that grants execute-api:Invoke permission to the specific ECS task IAM role in Account A. Configure the ECS microservice code to sign HTTP requests with Signature Version 4 (SigV4).Answer
  2. B
    Create a custom Lambda authorizer in Account B. Configure the ECS task in Account A to obtain temporary security credentials from AWS Security Token Service (STS) in Account B, and pass the credentials in the Authorization header to the custom authorizer for manual signature verification.
  3. C
    Configure a Cognito User Pool authorizer on the API Gateway in Account B. Configure the ECS task in Account A to authenticate directly with an Amazon Cognito identity pool in Account B to obtain an ID token, and pass this token in the Authorization header.
  4. D
    Configure the API Gateway method to use Lambda Proxy integration with no authorizer. In the backend Lambda function, extract the caller's ECS task execution IAM role from the request context headers and return a 403 Forbidden response if the role does not match.

Answer

Configure the API Gateway method to use AWS_IAM authorization. Apply a resource policy to the API Gateway REST API in Account B that grants execute-api:Invoke permission to the specific ECS task IAM role in Account A. Configure the ECS microservice code to sign HTTP requests with Signature Version 4 (SigV4).
The correct configuration provides the most secure and operationally efficient mechanism by using API Gateway's native AWS_IAM authorization. By configuring an API Gateway resource policy, the developer can explicitly grant access to the IAM role associated with the ECS task in the external account. Since the client request must be signed, Signature Version 4 (SigV4) protocol ensures authentication and integrity of the request payload without requiring custom token management or custom Lambda authorizer code.

Step-by-Step Solution

1
Enable AWS_IAM authorization on the API Gateway REST API resource methods in Account B.
This enforces IAM-based authentication and authorization at the API Gateway level before any backend services are invoked.
To natively authenticate requests using IAM identity credentials without writing custom authorization code.
2
Configure the API Gateway resource policy in Account B to allow the execute-api:Invoke action, specifying the ARN of the ECS task IAM role from Account A as the Principal.
This establishes cross-account permission, allowing the specific ECS container identity to access the private API Gateway REST API.
To adhere to the principle of least privilege by restricting access to only the specific identity requiring it.
3
Implement Signature Version 4 (SigV4) signing in the ECS microservice application code for outgoing HTTP requests to API Gateway.
Requests are securely signed with temporary AWS credentials from the ECS task IAM role, enabling API Gateway to verify the sender's identity.
To satisfy API Gateway's requirement for SigV4-signed requests when using AWS_IAM authorization.

Key Concept

Cross-account service-to-service authentication using API Gateway AWS_IAM authorization and Resource Policies.
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic