Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is designing a secure communication channel between an internal inventory processing application running on Amazon ECS tasks and a backend Amazon API Gateway REST API in the same AWS account. The API must only accept requests originating from the ECS tasks, and unauthorized access must be blocked at the API Gateway layer before invoking any backend integration. The developer wants to implement this security control with the least administrative and custom development effort.

Which of the following authorization strategies meets these requirements?

  1. Configure the API Gateway method authorization to AWS_IAM, attach an IAM policy to the ECS Task Role allowing the execute-api:Invoke action, and configure the ECS application to sign requests using Signature Version 4.Answer
  2. B
    Configure a Lambda custom authorizer that intercepts incoming requests, parses the ECS container metadata, and manually validates the caller's IAM role credentials against an access control list.
  3. C
    Configure an Amazon Cognito Identity Pool as the API Gateway method authorizer, and configure the ECS application to obtain and submit OpenID Connect tokens to authenticate requests.
  4. D
    Set up API Gateway to use Lambda Proxy Integration, and write custom validation logic in the backend Lambda function to verify the caller's identity in the request context.

Answer

Configure the API Gateway method authorization to AWS_IAM, attach an IAM policy to the ECS Task Role allowing the execute-api:Invoke action, and configure the ECS application to sign requests using Signature Version 4.
The correct strategy leverages the native AWS_IAM authorization feature of Amazon API Gateway. When a REST API method is configured with AWS_IAM authorization, callers must sign their requests using AWS Signature Version 4 (SigV4). The ECS Task Role is granted permissions via an IAM policy allowing the execute-api:Invoke action. This approach meets all security requirements, enforces authorization at the API Gateway layer before invoking backend resources, and requires zero custom code or authorizer management.

Step-by-Step Solution

1
Select the built-in AWS_IAM authorization type on the API Gateway method configuration page.
This ensures that API Gateway intercepts incoming requests and expects them to be signed using Signature Version 4 (SigV4).
Enabling native IAM authorization blocks unauthorized requests at the edge (API Gateway layer) without running backend code or custom Lambda authorizers.
2
Assign an IAM policy to the ECS Task Role with permission to execute the invoke action on the API Gateway resource.
The ECS task gains permission to call the API Gateway endpoint under the action execute-api:Invoke.
This implements the principle of least privilege, granting only the necessary permissions to the specific ECS task executing the application.
3
Configure the ECS application code to sign outgoing HTTPS requests to the API Gateway endpoint using AWS Signature Version 4.
The requests contain the necessary authorization headers (derived from the temporary ECS credentials) for API Gateway to validate.
SigV4 signing is required for any request authenticated via AWS_IAM.

Key Concept

API Gateway AWS_IAM Authorization
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic