Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A company is developing a fitness tracking mobile application. The application needs to access a REST API hosted on Amazon API Gateway to retrieve user workout histories. The development team wants to implement an authorization mechanism that allows users to authenticate using their existing email and password credentials, validates their JSON Web Tokens (JWTs) directly at the API Gateway level without invoking a custom Lambda function, and extracts user identity claims for backend processing. Which configuration should the developer implement to meet these requirements with the lowest latency and operational overhead?

  1. Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.Answer
  2. B
    Configure an Amazon Cognito Identity Pools authorizer directly on the API Gateway REST API.
  3. C
    Implement a custom Lambda authorizer that fetches public keys from the Cognito User Pool to validate the JWT.
  4. D
    Configure API Gateway with Lambda Proxy integration to inspect and validate the JWT inside the backend integration function.

Answer

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.
The correct configuration is to use the built-in Amazon Cognito User Pools authorizer. This option integrates directly with the user pool to authenticate and validate the signature of incoming JWT tokens without invoking custom Lambda code. Once validated, user claims are automatically populated into the request context and sent to the backend integration, providing a highly optimized, low-overhead solution.

Step-by-Step Solution

1
Analyze the requirements for user authentication, token validation, and latency control.
The solution requires user directory authentication (username/password), token validation at the API Gateway edge without executing custom code, and access to identity claims in backend integrations.
This establishes that the solution must use a native API Gateway mechanism rather than custom authorizer code.
2
Select the appropriate Amazon Cognito feature for user directories.
Cognito User Pools provides the directory and authentication flow, returning JWT tokens containing claims.
Cognito Identity Pools provides temporary AWS credentials instead of user authentication directory features.
3
Configure the native API Gateway authorizer that integrates directly with the Cognito User Pool.
Configuring a Cognito User Pools authorizer on the API Gateway REST API allows native verification of the JWT signature and expiration, and automatically passes the claims via the integration request context.
This provides the lowest latency and requires no custom code maintenance, satisfying all requirements.

Key Concept

API Gateway Cognito User Pools Authorizer
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic