Examkin

Question

Difficulty: HardAmazon Cognito Authentication and Authorization

An engineering team is developing a document management application. The application's frontend is a single-page application (SPA). The backend APIs are deployed on Amazon API Gateway (REST API) with AWS Lambda integrations. The application uses an Amazon Cognito User Pool for user authentication, which includes federated identity providers. The backend Lambda functions must receive the authenticated user's custom department attribute ('custom:department') to authorize document access at the application layer. The developers want to implement a highly performant and secure authorization mechanism that minimizes API calls and operational overhead.

Which solution should the developer implement to meet these requirements?

  1. Configure an Amazon API Gateway Cognito User Pool Authorizer. Configure the frontend to send the Cognito ID token in the Authorization header of API requests. Access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].Answer
  2. B
    Configure an Amazon API Gateway Cognito User Pool Authorizer. Configure the frontend to send the Cognito Access token in the Authorization header. In the backend Lambda function, call the Cognito Identity Provider GetUser API using the Access token to retrieve the custom:department attribute.
  3. C
    Create an Amazon API Gateway Lambda Authorizer. In the authorizer's Lambda function, parse the token from the header, call the Cognito AdminGetUser API using the AWS SDK to retrieve the user's attributes, and pass the department attribute in the authorizer context.
  4. D
    Configure an Amazon Cognito Identity Pool using the User Pool as the identity provider. Configure the frontend to exchange the User Pool token for temporary AWS credentials, sign the API Gateway requests using Signature Version 4 (SigV4), and map the department attribute to the IAM role session tags to be passed to Lambda.

Answer

Configure an Amazon API Gateway Cognito User Pool Authorizer, configure the frontend to send the Cognito ID token in the Authorization header of API requests, and access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].
The correct solution uses the built-in API Gateway Cognito User Pool Authorizer along with the Cognito ID token. The ID token natively carries user profile attributes, including the custom department attribute. Once validated by the authorizer, API Gateway automatically injects these claims into the Lambda integration context under the path 'event.requestContext.authorizer.claims'. This fulfills the security and functional requirements without requiring any custom validation code, downstream API queries, or Cognito Identity Pool credential exchanges, thereby minimizing execution latency and operational overhead.

Step-by-Step Solution

1
Select the appropriate Amazon Cognito token type.
Cognito ID tokens contain user identity claims, including custom attributes such as 'custom:department', whereas standard Access tokens do not contain these user-specific directory attributes by default.
Choosing the ID token ensures that the required custom user attributes are sent to the gateway without requiring back-channel API requests to retrieve them.
2
Configure the API Gateway Authorizer.
Create a built-in Cognito User Pool Authorizer on API Gateway and associate it with the REST API resource methods. Set the Authorization header as the token source.
Using the built-in Cognito Authorizer offloads token signature verification and expiration checks to API Gateway, avoiding the operational overhead of managing custom authorizer functions.
3
Extract claims inside the backend Lambda function.
In the backend Lambda handler, read the custom attribute from 'event.requestContext.authorizer.claims["custom:department"]'.
When using a Cognito User Pool Authorizer with API Gateway Lambda proxy integration, the gateway automatically populates the claims from the validated ID token into the request context, allowing the backend to retrieve the attribute with zero database or API lookups.

Key Concept

Amazon API Gateway Cognito User Pool Authorizers natively validate ID tokens and inject user claims, including custom attributes, into the backend Lambda context, avoiding the latency and cost of custom authorizers or downstream user lookup APIs.
Estimated Time:2m 0s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic