Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A company is building an employee portal that allows users to access internal resources via an Amazon API Gateway REST API. The client application authenticates users directly using an Amazon Cognito User Pool. The developer needs to secure the API Gateway methods to ensure that only users authenticated by this Cognito User Pool can access the endpoints. The solution must minimize development effort and avoid unnecessary execution costs.

Which two of the following configuration steps must be performed in Amazon API Gateway to secure the API?

  1. Create a Cognito user pool authorizer in API Gateway by specifying the Amazon Cognito User Pool ARN and the token source header name.Answer
  2. B
    Create a Cognito identity pool authorizer in API Gateway by specifying the Identity Pool ID and the token source header name.
  3. Edit the Method Request settings for the API methods, select the Cognito authorizer as the Authorization type, and redeploy the API.Answer
  4. D
    Create a custom Lambda authorizer that extracts the JSON Web Token (JWT) from the headers, verifies it using public keys, and returns an IAM policy.
  5. E
    Configure the integration request as a Lambda Proxy integration and implement code in the backend Lambda function to validate the JWT.

Answer

To secure the API natively using Cognito User Pools with the least overhead, the developer must create a Cognito user pool authorizer in API Gateway, link it to the Method Request settings for the API methods, and redeploy the API.
To secure the API with the minimum development and operational overhead, the developer should create a native Cognito User Pool authorizer by linking the Amazon Cognito User Pool ARN and the token source header name. The authorizer must then be assigned to the API's Method Request settings, followed by a redeployment of the API. This native validation does not require writing custom code and does not incur Lambda execution costs for the authorization layer.

Step-by-Step Solution

1
Create a Cognito user pool authorizer in the API Gateway configuration.
A native authorizer of type COGNITO is registered using the Cognito User Pool ARN and configured with a token header source (e.g., Authorization).
This establishes the validation connection between API Gateway and the Cognito User Pool so API Gateway can verify incoming JWT tokens.
2
Configure the API Gateway Method Request settings to use the Cognito authorizer.
The API Gateway method settings are updated to enforce authentication using the Cognito authorizer.
This binds the authorizer to specific endpoints and methods, preventing unauthenticated requests from passing through.
3
Deploy the API Gateway API to a stage.
The API configuration updates are applied to the active stage endpoint.
API Gateway requires an active deployment for configuration updates, including authorization settings, to become active for clients.

Key Concept

API Gateway integration with Amazon Cognito User Pools
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic