Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A company has an administrative backend service exposed through an Amazon API Gateway REST API. A developer needs to grant access to this API to a serverless processing application running under a specific IAM role in a different AWS account. The connection must be secure and follow the principle of least privilege without requiring the maintenance of user directories or custom code. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

  1. Set the authorization type of the API Gateway method to AWS_IAM.Answer
  2. Apply a resource policy to the API Gateway REST API that grants execute-api:Invoke permissions to the consumer IAM role ARN.Answer
  3. C
    Create a custom Lambda authorizer that receives the caller's role ARN and uses the AWS Security Token Service (AWS STS) to validate the signature.
  4. D
    Configure an Amazon Cognito Identity Pool to authenticate the serverless application's IAM role and generate a JSON Web Token (JWT) to pass to a Cognito User Pool authorizer.
  5. E
    Configure Lambda proxy integration for the API method and use a request body mapping template to extract and verify the caller's Signature Version 4 credentials.

Answer

To implement cross-account access securely under least privilege without custom code or user directories, set the API Gateway method authorization to AWS_IAM and apply an API Gateway resource policy that grants the external IAM role ARN access to execute-api:Invoke.
To secure the API for cross-account access without using custom code or user directories, AWS_IAM authorization is the native and most secure solution. By setting the authorization type of the API Gateway method to AWS_IAM, the API will require all requests to be signed using Signature Version 4 (SigV4) with credentials associated with an IAM identity. Then, using an API Gateway resource policy allows cross-account authorization by explicitly permitting the specific external IAM role ARN to execute the API method.

Step-by-Step Solution

1
Enable IAM authentication on the API Gateway method.
The API method now requires all requests to be signed using Signature Version 4 (SigV4) with valid AWS IAM credentials.
This ensures that API Gateway natively evaluates the identity of the incoming caller using standard AWS IAM signatures.
2
Configure the REST API resource policy.
A resource policy is attached to the API Gateway that allows the principal ARN corresponding to the consumer's IAM role to invoke the 'execute-api:Invoke' action.
This permits cross-account API invocation by specifying exactly which external IAM identity is allowed access.

Key Concept

Cross-account IAM authentication and authorization for Amazon API Gateway REST APIs.
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic