Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is implementing a secure corporate portal that exposes sensitive administrative endpoints through an Amazon API Gateway REST API. The portal's frontend application authenticates users against an Amazon Cognito User Pool. The developer wants to restrict access to these REST API endpoints to authenticated users only. To comply with security best practices and keep development and operational overhead to a minimum, the developer wants to avoid writing and maintaining custom code for token verification. Which approach should the developer use to authorize these API requests?

  1. A
    Enable Lambda Proxy integration for the backend Lambda function, extract the authorization header inside the function code, and manually verify the token using the Amazon Cognito SDK.
  2. B
    Create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from the Amazon Cognito User Pool to manually validate the signature of the incoming bearer token.
  3. Configure an Amazon Cognito User Pool authorizer on the API Gateway resources, and verify the authorization by passing the identity JSON Web Token (JWT) in the request headers.Answer
  4. D
    Configure an Amazon Cognito Identity Pool to authenticate users directly, and use temporary AWS credentials in the request headers to authenticate against an API Gateway Cognito Authorizer.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway resources, and verify the authorization by passing the identity JSON Web Token (JWT) in the request headers.
Configuring an Amazon Cognito User Pool authorizer is a native, built-in feature of Amazon API Gateway. It validates JSON Web Tokens (JWT) sent in the request header directly against the configured Cognito User Pool without executing custom Lambda code. This approach eliminates custom code development, reduces operational overhead, and minimizes execution costs.

Step-by-Step Solution

1
Identify the authentication source and authorization requirements.
Users authenticate against an Amazon Cognito User Pool, and the API Gateway REST API must allow access only to these authenticated users.
Establishing the source of the identity tokens helps determine which built-in integrations are available.
2
Evaluate the constraints regarding development and operational overhead.
Custom code for token verification must be avoided.
This eliminates custom Lambda authorizers or validation within the backend Lambda function, favoring native API Gateway integrations.
3
Select the built-in, code-free API Gateway security mechanism.
Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API resources.
This native feature validates the JWT signature and expiration directly at the API Gateway layer without requiring custom code or extra Lambda execution.

Key Concept

Natively securing Amazon API Gateway REST APIs using Cognito User Pool Authorizers to validate JSON Web Tokens (JWT) without custom code execution.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic