Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A telemetry data analysis company is building a REST API using Amazon API Gateway. The API will be consumed by two distinct groups:

1. Internal microservices running on Amazon EC2 instances that need to invoke the API securely using their IAM roles.
2. External customer applications that authenticate against an external identity provider and send a custom JSON Web Token (JWT) containing dynamic billing tier claims.

The developer needs to configure the security and authorization for this API in a way that minimizes custom code for standard authentication, supports fine-grained billing-tier checks, and ensures minimum latency.

Which two configuration steps should the developer perform to meet these requirements?

  1. Configure AWS_IAM authorization on the API resources accessed by the internal microservices, and grant the EC2 instance profile roles the execute-api:Invoke permission.Answer
  2. Create an API Gateway Lambda authorizer of type REQUEST to validate the custom JWT and enforce authorization based on the dynamic billing tier claims.Answer
  3. C
    Configure an Amazon Cognito Identity Pool to directly authorize the external custom JWTs at the API Gateway method request level.
  4. D
    Configure a built-in Amazon Cognito User Pool authorizer to validate and decode the external custom JWTs containing the dynamic billing tier claims.
  5. E
    Configure the API method to use a Lambda Proxy integration to inspect the billing tier claims and return a 403 Forbidden status code if unauthorized.

Answer

Configure AWS_IAM authorization on the API resources accessed by the internal microservices with execute-api:Invoke permissions, and create an API Gateway Lambda authorizer of type REQUEST to validate the custom JWT and enforce billing tier claims.
The correct configuration requires utilizing AWS_IAM authorization for callers that possess IAM credentials (the internal microservices), and implementing a custom Lambda authorizer of type REQUEST to handle external clients sending custom JWTs with proprietary billing claims. This setup ensures that API Gateway offloads standard authentication natively and handles complex claims verification securely before hitting backend integrations.

Step-by-Step Solution

1
Evaluate the authentication requirements for the internal microservices.
Since internal microservices on Amazon EC2 have IAM roles, using AWS_IAM authorization is the native choice requiring no custom authentication code.
AWS_IAM authorization allows API Gateway to natively leverage IAM policies and signature verification, minimizing latency and code overhead.
2
Evaluate authorization mechanisms for custom third-party JWTs.
Built-in Cognito authorizers cannot process custom external tokens directly. A custom Lambda authorizer must be used.
Lambda authorizers execute custom validation logic, which is required to parse proprietary JWTs and evaluate claims such as billing tiers.
3
Select the correct Lambda authorizer structure.
A REQUEST-type Lambda authorizer receives headers, query strings, and stage variables to execute verification.
A REQUEST authorizer provides flexibility to validate the authorization header and use caching to optimize latency for subsequent API requests.

Key Concept

API Gateway Authorizers and IAM Access Control
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic