Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

An enterprise is deploying a REST API using Amazon API Gateway. The API will be accessed solely by internal server-to-server microservices running on Amazon EC2 instances within a private VPC. The security policy mandates that all communication must be encrypted, credentials must not be hardcoded in application code, and access must be restricted using IAM policies based on the principle of least privilege. Which configuration should a developer implement to secure the API Gateway with the least operational effort?

  1. Enable AWS_IAM authorization on the API Gateway methods. Associate an IAM role with the EC2 instances that grants permissions for the `execute-api:Invoke` action, and configure the clients to sign their API requests using Signature Version 4.Answer
  2. B
    Configure a Cognito User Pool Authorizer on the API Gateway methods. Use Amazon Cognito Identity Pools to exchange the EC2 instance role credentials for a JSON Web Token (JWT) to pass in the Authorization header.
  3. C
    Create a custom Lambda authorizer for the API Gateway methods. Write code within the Lambda authorizer to validate the Signature Version 4 signature of incoming requests against IAM policies before allowing access.
  4. D
    Set up the API Gateway integration as a Lambda proxy integration. Configure the backend Lambda function to inspect the raw request headers, extract the access key, and verify permissions against an IAM policy before returning a response.

Answer

Enable AWS_IAM authorization on the API Gateway methods, associate an IAM role with the EC2 instances granting the `execute-api:Invoke` action, and sign requests using Signature Version 4.
The correct option is to enable AWS_IAM authorization on the API Gateway methods, associate an IAM role with the EC2 instances, and configure the client to sign requests with Signature Version 4. This utilizes API Gateway's built-in capabilities to validate access using IAM roles without requiring custom authorization logic or external token providers, providing the least operational overhead.

Step-by-Step Solution

1
Select AWS_IAM as the authorization type on the target API Gateway resource methods.
API Gateway will now reject any requests to these methods that are not signed with valid AWS Signature Version 4 credentials.
This offloads authorization and credential validation entirely to AWS, eliminating the need to write custom verification logic.
2
Assign an IAM execution role (via an EC2 instance profile) to the EC2 instances running the microservices, and attach a policy permitting `execute-api:Invoke` on the API Gateway resource ARN.
The microservices can retrieve temporary security credentials from the EC2 instance metadata service.
This satisfies the requirement that credentials must not be hardcoded, adhering to IAM least-privilege principles.
3
Configure the microservice client applications to sign their outgoing HTTP requests to the API Gateway using AWS Signature Version 4 (SigV4) with the temporary credentials.
The requests are successfully authenticated and authorized by API Gateway.
SigV4 signing is required for any API Gateway method configured with AWS_IAM authorization.

Key Concept

AWS_IAM Authorization in API Gateway
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic