Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is configuring security for an Amazon API Gateway REST API. The API needs to validate JSON Web Tokens (JWT) issued by an Amazon Cognito User Pool. Additionally, the backend Lambda function, which is integrated using a Lambda Proxy integration, must be able to read the user's group memberships to apply application-level authorization. Which two configuration steps should the developer perform to achieve this? (Select TWO.)

  1. Create an Amazon Cognito User Pool authorizer in API Gateway, pointing to the user pool, and set the Identity Source to read the Authorization header.Answer
  2. Configure the API Gateway resource methods to use the Cognito User Pool authorizer, and extract the group memberships from the request context authorizer claims in the Lambda function.Answer
  3. C
    Create an Amazon Cognito Identity Pool authorizer in API Gateway, and configure the clients to sign API requests using AWS Signature Version 4.
  4. D
    Deploy a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from Cognito to verify the JWT and inject the groups into custom headers for every request.
  5. E
    Configure a Lambda Custom integration and define an API Gateway mapping template to extract the Cognito claims from the request headers and map them into the event object.

Answer

Create a Cognito User Pool authorizer configured to read the Authorization header, associate it with the API methods, and access the groups from the event request context authorizer claims in the Lambda function.
The correct options describe creating a Cognito User Pool authorizer and configuring it on the API methods, while retrieving the token claims directly from the request context authorizer claims. This provides a secure, native, and low-latency solution that leverages API Gateway's built-in validation capabilities. Under a Lambda Proxy integration, the validated token claims are automatically passed to the Lambda function's event payload.

Step-by-Step Solution

1
Create and configure a Cognito User Pool authorizer in Amazon API Gateway.
API Gateway is configured to automatically inspect the token source header (e.g., Authorization) and validate the JWT signature against the Cognito User Pool.
This establishes native token validation at the API Gateway layer without writing custom authorizer code.
2
Set the API methods to use the created Cognito User Pool authorizer.
The API resources are secured, and unauthenticated requests are blocked with a 401 Unauthorized status.
This applies the authorizer security to the specific methods that require authentication.
3
Access the user's groups in the backend Lambda function from the proxy event context.
The Lambda function code retrieves claims from the event structure at `event.requestContext.authorizer.claims['cognito:groups']`.
Since the API uses a Lambda Proxy integration, API Gateway automatically passes the validated token claims down to the backend integration.

Key Concept

API Gateway Cognito User Pool Authorizers and requestContext claims propagation with Lambda Proxy integration.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic