Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API must authenticate users who are managed in an external identity provider that supports OpenID Connect (OIDC). The requirements specify that the solution must minimize custom code, validate the JSON Web Token (JWT) at the API Gateway layer, and securely pass user attributes—such as custom groups—to the backend Lambda function for fine-grained authorization. Additionally, the client application must not need to manage or sign requests with temporary AWS credentials.

Which architecture should the developer implement to meet these requirements with the least administrative effort?

  1. Configure an Amazon Cognito User Pool federated with the external OIDC provider. Set up an API Gateway Cognito Authorizer that points to the Cognito User Pool. In the API Gateway Method Request, set the Authorization header. In the backend Lambda function, extract the user attributes from the request's context event under the authorizer claims.Answer
  2. B
    Configure an Amazon Cognito Identity Pool federated with the external OIDC provider. Set up an API Gateway IAM Authorizer. Have the client application exchange the OIDC token for temporary AWS credentials using the Identity Pool, sign each HTTP request using Signature Version 4, and pass user attributes in custom headers.
  3. C
    Create a custom Lambda authorizer that performs manual token signature validation using a public key endpoint from the external OIDC provider. In the Lambda authorizer, parse the custom groups and return them inside the context object of the authorization response. Access these claims inside the backend Lambda function using a custom integration mapping template.
  4. D
    Configure an Amazon Cognito User Pool federated with the external OIDC provider. Configure a custom Lambda authorizer to intercept the token and write a Lambda Proxy Integration mapping template to parse the JWT payload. Inside the backend Lambda function, map the raw request payload back to the Cognito User Pool to retrieve user attributes.

Answer

Configure an Amazon Cognito User Pool federated with the external OIDC provider, set up an API Gateway Cognito Authorizer pointing to the user pool, and extract the user attributes from the request's context event under the authorizer claims in the backend Lambda function.
The correct solution uses an Amazon Cognito User Pool federated with the external OIDC provider. This configuration allows API Gateway to leverage the built-in Cognito Authorizer, which handles token validation at the gateway edge. Verified claims are automatically passed to the Lambda function in the request context event, eliminating custom validation code and client-side request signing.

Step-by-Step Solution

1
Analyze the token validation requirements and identity source.
The identity source is an external OIDC provider, and token validation must happen at the API Gateway layer.
This establishes that the API Gateway layer should handle validation, narrowing options to authorizers that natively validate OIDC/JWT tokens.
2
Evaluate native authorization options versus client-side overhead.
Using a Cognito Identity Pool requires IAM authorization and Signature Version 4 signing by the client, which violates the requirement to avoid client-side credentials management.
A Cognito User Pool with a Cognito Authorizer validates OIDC-derived tokens natively at the API Gateway edge, avoiding client-side request signing.
3
Verify custom code and claim transmission constraints.
A custom Lambda authorizer requires manual signature validation and parsing, violating the goal to minimize custom code. In contrast, the Cognito Authorizer automatically passes validated claims to the backend Lambda integration's request context.
This confirms that a federated Cognito User Pool combined with a native Cognito Authorizer is the most efficient, low-code solution.

Key Concept

API Gateway Cognito User Pool Authorizer integration for federated OIDC authentication.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic