Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is building a serverless e-learning application where students log in using an Amazon Cognito User Pool. The application's frontend client needs to access course content through an Amazon API Gateway REST API. The developer needs to secure the API so that only authenticated students can access the resource, verifying their identity directly via their login session tokens. Which solution should the developer implement to meet these requirements with the least operational overhead?

  1. A
    Create a Lambda authorizer in API Gateway that decodes the incoming token, makes an API call to Cognito User Pools to validate it, and returns an IAM policy.
  2. Create an Amazon Cognito User Pool authorizer in API Gateway, configure it with the student User Pool, and set the API method authorization to use this authorizer.Answer
  3. C
    Create an Amazon Cognito Identity Pool authorizer in API Gateway, configure it with the student identity provider, and set the API method authorization to use this authorizer.
  4. D
    Create a Lambda Proxy integration in API Gateway, configure a method execution mapping to validate Cognito tokens, and pass the claims in the request template.

Answer

Create an Amazon Cognito User Pool authorizer in API Gateway, configure it with the student User Pool, and set the API method authorization to use this authorizer.
API Gateway natively supports Amazon Cognito User Pools authorizers, allowing developers to secure REST APIs by validating user identity tokens directly against the configured User Pool. This requires zero custom code, minimizing development and operational overhead.

Step-by-Step Solution

1
Analyze the authentication provider and target API structure.
The application uses Amazon Cognito User Pools for directory management and login token generation, and accesses resources via an API Gateway REST API.
Understanding the source of credentials is critical to choosing the correct authorization path.
2
Evaluate native verification capabilities of API Gateway.
API Gateway natively supports Cognito User Pools authorizers, which validate JSON Web Tokens (JWTs) automatically.
Using a native feature eliminates the need to develop, test, and pay for custom code execution.
3
Select the option that configures the native authorizer on API Gateway.
Configuring the API method to use the Cognito User Pools authorizer meets the security requirement with the least operational overhead.
This avoids custom Lambda code or the credential exchange overhead associated with Cognito Identity Pools.

Key Concept

API Gateway native Cognito User Pool authorizer integration
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic