Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A digital media streaming service uses Amazon API Gateway to expose a REST API that retrieves subscriber profiles. The backend integration uses an AWS Lambda function with a proxy integration. The company uses a custom external identity provider that issues JSON Web Tokens (JWTs) to authenticated users. The developer must secure the API Gateway endpoints to ensure that only users with an active subscription (indicated by a claim named 'subscriptionStatus' with a value of 'active' inside the JWT payload) can access the API. The solution must minimize costs by preventing unauthorized requests from invoking the backend Lambda function, and must cache the authorization decision for 5 minutes. Which security configuration will meet these requirements?

  1. Configure a Lambda token authorizer in API Gateway. In the authorizer's Lambda function, validate the JWT signature, extract the 'subscriptionStatus' claim, and return an IAM policy that allows access if the status is active or denies access otherwise. Enable authorizer caching and set the identity source to the header containing the JWT.Answer
  2. B
    Configure an Amazon Cognito User Pool Authorizer in API Gateway. In the API Gateway method settings, set the authorization to the Cognito User Pool, and configure a Gateway Response to check the 'subscriptionStatus' claim value. Enable API Gateway execution caching for 5 minutes with the token header as the cache key.
  3. C
    Configure an Amazon Cognito Identity Pool to federate with the external identity provider. Configure the API Gateway method to use IAM Authorization. Write a custom IAM policy that grants invoke permissions to API Gateway only if the 'subscriptionStatus' tag is present in the request credentials, and assign it to the Cognito authenticated role.
  4. D
    Set the API Gateway authorization to NONE to bypass authorizers. In the backend Lambda function, validate the JWT signature, inspect the 'subscriptionStatus' claim, and return a 403 Forbidden response if the status is not active. Enable API Gateway method execution caching for 5 minutes with the authorization header as the cache key.

Answer

Configure a Lambda token authorizer in API Gateway. In the authorizer's Lambda function, validate the JWT signature, extract the 'subscriptionStatus' claim, and return an IAM policy that allows access if the status is active or denies access otherwise. Enable authorizer caching and set the identity source to the header containing the JWT.
The correct solution involves configuring a Lambda token authorizer. A Lambda authorizer executes custom logic (such as checking if 'subscriptionStatus' is 'active' in the JWT payload) and returns an IAM policy. Because API Gateway evaluates this policy before invoking the integration backend, unauthorized requests are blocked early, preventing unnecessary backend executions. Enabling caching on the authorizer ensures that subsequent requests with the same token use the cached policy for 5 minutes, optimizing performance and reducing authorizer costs.

Step-by-Step Solution

1
Select the appropriate API Gateway authorization type for custom JWT validation and claim inspection.
Determine that a Lambda token authorizer (custom authorizer) is required because it allows running custom validation logic (such as checking the 'subscriptionStatus' claim value) on incoming JWTs, which built-in Cognito Authorizers or IAM Authorization cannot perform natively.
API Gateway Cognito Authorizers can validate JWT tokens from Cognito User Pools but cannot perform conditional authorization checks on custom claims before deciding to allow or deny the request.
2
Implement the authorization logic within the Lambda authorizer function.
The Lambda function receives the token, validates its signature, extracts the payload, checks if 'subscriptionStatus' is 'active', and generates an IAM policy with an Allow or Deny effect along with the user's principal ID.
API Gateway requires the Lambda authorizer to return an IAM policy document that explicitly allows or denies the execution of the API method.
3
Configure caching for the Lambda authorizer in the API Gateway console.
Enable caching, set the TTL (Time to Live) to 300 seconds (5 minutes), and specify the identity source header (e.g., method.request.header.Authorization) as the cache key.
Caching the policy document prevents API Gateway from invoking the Lambda authorizer function for subsequent requests containing the same token, minimizing latency and Lambda invocation costs.

Key Concept

API Gateway Custom Lambda Authorizers allow developers to validate incoming custom tokens (like JWTs from external providers) and perform fine-grained authorization checks based on claims before routing the request to the backend integration, with optional caching to control costs.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic