A developer is designing a REST API using Amazon API Gateway. The API must support two distinct clients: a mobile application where users authenticate and receive JSON Web Tokens (JWTs) from Amazon Cognito, and a legacy third-party application that sends custom tokens that must be validated against an external database.
Which two authorization mechanisms should the developer configure on API Gateway to secure these client requests? (Select TWO.)
- Configure a Cognito User Pools authorizer to validate the JWTs sent by the mobile application.Answer
- Configure a custom Lambda authorizer to parse and validate the legacy client application tokens.Answer
- CConfigure a Cognito Identity Pools authorizer to validate the JWTs sent by the mobile application.
- DConfigure a custom Lambda authorizer to decode and validate the Cognito User Pool ID tokens.
- EConfigure a Lambda proxy integration to validate the custom legacy client tokens within the backend integration.
Answer
Configure a Cognito User Pools authorizer to validate the JWTs sent by the mobile application, and configure a custom Lambda authorizer to parse and validate the legacy client application tokens.
To secure the API requests, a native Cognito User Pools authorizer should be used for the mobile application since API Gateway natively decodes and validates Cognito JWTs. For the legacy client application, a custom Lambda authorizer is required to extract the token and perform custom validation logic against the external database.
Step-by-Step Solution
Key Concept
Selecting native Cognito User Pools authorizers for Cognito JWTs and custom Lambda authorizers for custom token structures and external database lookups.