Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A software engineer is configuring security for a web application where clients send requests to a REST API hosted on Amazon API Gateway. The application uses an Amazon Cognito User Pool for user authentication. The engineer must restrict access to the REST API so that only authenticated users with a valid JSON Web Token (JWT) can call the endpoints, without writing custom code to decode or validate the tokens. Which solution meets these requirements with the least operational overhead?

  1. Configure an Amazon Cognito authorizer on the API Gateway REST API, referencing the User Pool, and pass the identity token in the request header.Answer
  2. B
    Configure a custom Lambda authorizer on the API Gateway REST API. In the Lambda function, fetch the JSON Web Key Set (JWKS), decode the token, and validate the token signature.
  3. C
    Configure an Amazon Cognito Identity Pool as the authorizer for the API Gateway REST API to automatically validate the user's JSON Web Token (JWT) token.
  4. D
    Create an IAM trust policy that allows API Gateway to assume an IAM role associated with the Amazon Cognito User Pool to validate each request.

Answer

Configure an Amazon Cognito authorizer on the API Gateway REST API, referencing the User Pool, and pass the identity token in the request header.
The correct solution uses an API Gateway Cognito authorizer linked to the Amazon Cognito User Pool. This is a built-in feature that automatically validates incoming JWT tokens (such as the ID token) without requiring any custom Lambda code, meeting all constraints with the lowest operational overhead.

Step-by-Step Solution

1
Identify the requirement to authenticate users using Amazon Cognito User Pools and authorize access to API Gateway without custom code.
Confirm that user identity validation must occur at the API Gateway layer without custom validation logic.
This helps narrow down the solutions to native integration options on API Gateway.
2
Evaluate built-in API Gateway authorizers and note that a Cognito Authorizer natively integrates with Cognito User Pools to validate tokens automatically.
Determine that the Amazon Cognito authorizer is the built-in mechanism designed for this specific scenario.
Using a native feature avoids the development and operational overhead of custom code or identity pools.
3
Pass the identity token (ID token) or access token generated by the User Pool in the request header (commonly Authorization) to the Cognito authorizer.
API Gateway automatically decodes, verifies, and validates the incoming token against the configured User Pool.
This ensures only authenticated clients with valid tokens are allowed to invoke the backend service.

Key Concept

API Gateway integration with Amazon Cognito User Pools using Cognito Authorizers
Estimated Time:1m 30s
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic