Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is securing a REST API in Amazon API Gateway for a social media application. Users authenticate via a web frontend using Amazon Cognito. The developer needs to restrict access to the API Gateway resources to authenticated users only and pass the user's username and email to the backend AWS Lambda function for auditing. The solution must minimize custom code and use built-in API Gateway features. Which two steps must the developer perform to meet these requirements? (Select TWO.)

  1. Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.Answer
  2. In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.Answer
  3. C
    Configure an API Gateway Cognito Identity Pool Authorizer and associate it with the API methods.
  4. D
    Create an API Gateway Lambda Custom Authorizer to validate the JWT and return an IAM policy allowing the request.
  5. E
    Configure a Lambda Custom Integration (non-proxy) and parse the Authorization header inside the Lambda function using a mapping template.

Answer

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods, and extract the user's identity details from the event.requestContext.authorizer.claims context object in the backend Lambda function.
To secure the API with minimal custom code, the developer should configure an API Gateway Cognito User Pool Authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) issued by Cognito User Pools. Once validated, API Gateway automatically propagates the user's token claims (including email and username) to the backend integration, where they can be extracted directly from the requestContext.authorizer.claims context variable inside the Lambda function.

Step-by-Step Solution

1
Select the built-in Cognito User Pool Authorizer in API Gateway.
API Gateway is configured to automatically validate the JWT tokens sent by the client frontend.
This avoids writing custom validation code and utilizes AWS managed capabilities.
2
Associate the authorizer with the specific HTTP/REST methods on the API Gateway resource.
Unauthenticated requests are blocked at the gateway level with a 401 Unauthorized response, protecting the backend.
This secures the endpoints before requests reach the backend Lambda function.
3
Access the user claims within the Lambda handler using the integration event object.
The Lambda function receives the username and email in the event object without performing additional decoding or verification.
API Gateway automatically populates the claims under requestContext.authorizer.claims when the Cognito authorizer successfully validates the token.

Key Concept

API Gateway Cognito User Pools Integration
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic