Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A smart agriculture company is developing a system where IoT field sensors and farm managers access backend microservices through an Amazon API Gateway REST API. The field sensors must securely publish telemetry data at regular intervals using IAM roles, while the farm managers must log in using an email and password to view and control irrigation systems through a web interface. The developer needs to secure both endpoints with the least administrative overhead. Which TWO actions should the developer take to configure the API Gateway security? (Select TWO.)

  1. Configure the telemetry endpoint to use AWS_IAM authorization, requiring the sensors to sign their HTTPS requests using Signature Version 4 (SigV4).Answer
  2. Configure the management endpoint to use an Amazon Cognito User Pools authorizer to authenticate and validate the JSON Web Tokens (JWTs) of the farm managers.Answer
  3. C
    Configure the management endpoint to use an Amazon Cognito Identity Pools authorizer to directly authenticate the credentials of the farm managers.
  4. D
    Create a custom Lambda authorizer for the management endpoint to decode, verify, and validate the Cognito User Pool JWTs manually.
  5. E
    Enable API Gateway Lambda proxy integration on the telemetry endpoint to automatically authenticate the sensor IAM roles.

Answer

To secure the REST API with the least administrative overhead, configure the telemetry endpoint to use AWS_IAM authorization, allowing sensors to sign their requests using Signature Version 4, and configure the management endpoint to use a Cognito User Pools authorizer to validate the JWTs of authenticated farm managers.
For IoT sensors configured with IAM roles, API Gateway's native AWS_IAM authorization validates calls signed with Signature Version 4 (SigV4) securely. For farm managers authenticating with a username and password, Cognito User Pools manage the user identities and generate JWTs, which API Gateway's native Cognito User Pools authorizer validates automatically without code.

Step-by-Step Solution

1
Determine the auth mechanism for IoT sensors.
Since sensors utilize IAM roles, they can authenticate via AWS Signature Version 4 (SigV4). Thus, the telemetry endpoint should use AWS_IAM authorization.
This natively supports IAM-based authorization without custom authentication logic.
2
Determine the auth mechanism for web users.
Since users authenticate with username/password, an Amazon Cognito User Pool is suitable. To authenticate API Gateway requests, the API should use a Cognito User Pools authorizer.
The Cognito User Pools authorizer natively validates JSON Web Tokens (JWTs) directly at the API Gateway level.
3
Minimize administrative overhead.
Avoid custom Lambda authorizers or external token parsing since native integration mechanisms exist.
Native integrations reduce maintenance, billing costs, and code complexity.

Key Concept

API Gateway authorization types (IAM authorization vs Cognito User Pools authorizers vs custom Lambda authorizers)
Estimated Time:2m 0s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic