Examkin

Question

Difficulty: EasyAPI Gateway Security and Authorization

A developer is building a REST API in Amazon API Gateway. The API needs to validate JSON Web Tokens (JWTs) sent by clients who have authenticated using an Amazon Cognito User Pool. The developer wants to implement this security check with the least configuration effort and no additional custom code. Which authorization method is the most appropriate to meet these requirements?

  1. Configure an API Gateway Cognito User Pool authorizer by specifying the User Pool ID and client ID.Answer
  2. B
    Create a custom Lambda authorizer that imports a JWT library to verify and decode the token signature.
  3. C
    Set up an Amazon Cognito Identity Pool to authenticate the requests and grant temporary IAM credentials to the API clients.
  4. D
    Use a Lambda proxy integration to forward the raw request headers and perform the token validation inside the backend Lambda function logic.

Answer

Configure an API Gateway Cognito User Pool authorizer by specifying the User Pool ID and client ID.
The correct option is configuring an API Gateway Cognito User Pool authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) generated by Cognito User Pools, eliminating the need to write, test, or pay for custom Lambda authorizer code.

Step-by-Step Solution

1
Identify the authorization requirements.
The API must validate JWTs generated specifically by an Amazon Cognito User Pool.
Knowing the token source helps determine if a native, built-in solution is available.
2
Evaluate native API Gateway features for Amazon Cognito.
Amazon API Gateway offers a built-in Cognito User Pool authorizer specifically designed to validate these JWT tokens without writing code.
This minimizes administrative overhead, custom code maintenance, and execution cost.
3
Select the option that requires the least configuration and coding effort.
Configuring the native Cognito User Pool authorizer meets all requirements with the lowest effort.
Other methods either require custom Lambda code or confuse User Pools with Identity Pools.

Key Concept

API Gateway Cognito User Pools Authorizer
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic