Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A startup is deploying a secure REST API on Amazon API Gateway. External clients will authenticate using JSON Web Tokens (JWTs) issued by a third-party identity provider. The startup needs to implement an authorization solution at the API Gateway layer that validates the JWT, denies unauthorized access before invoking backend resources, and performs fine-grained authorization based on the user's subscription tier claim embedded in the JWT. The backend is an AWS Lambda function integrated using a Lambda custom integration (non-proxy). Which approach meets these requirements with the least operational complexity?

  1. Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.Answer
  2. B
    Configure an Amazon Cognito Identity Pool to authenticate the third-party tokens. In API Gateway, configure a Cognito User Pool authorizer to validate the incoming token, and rely on API Gateway to automatically forward the user claims in the integration request to the backend Lambda custom integration.
  3. C
    Implement a Lambda custom authorizer to validate the JWT. Configure the authorizer to append the subscription tier claim as a custom header in the API Gateway integration request. Configure the backend Lambda function to automatically retrieve this header from the handler's default event.headers payload.
  4. D
    Implement a Lambda custom authorizer to validate the JWT. Configure the authorizer to return an IAM policy that allows execute-api:Invoke on the backend Lambda function's ARN, and passes the subscription tier claim using the $stageVariables.subscriptionTier context variable.

Answer

Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.
The correct approach involves using a Lambda custom authorizer because it allows validating JWTs from external identity providers. The authorizer returns an IAM policy allowing the execute-api:Invoke action on the API Gateway method ARN, along with a context map. Since the backend Lambda function is integrated using a Lambda custom integration (non-proxy), we must use an API Gateway mapping template to extract the subscription tier metadata from the authorizer context using the $context.authorizer.subscriptionTier variable and pass it to the backend Lambda function payload.

Step-by-Step Solution

1
Select the appropriate authorizer type for third-party identity providers.
Lambda custom authorizer is chosen because built-in Cognito User Pool authorizers are designed for Amazon Cognito User Pools, not arbitrary third-party JWTs.
API Gateway needs to validate external JWTs and deny access before invoking the backend integration.
2
Define the IAM policy and context returned by the custom authorizer.
The Lambda custom authorizer returns an IAM policy targeting the execute-api:Invoke action on the API Gateway method ARN, along with a context map payload containing the subscription tier claim.
The authorizer must authorize the API Gateway execution path and pass custom validation metadata downstream.
3
Map the authorizer context payload to the backend Lambda custom integration.
An API Gateway mapping template is created for the integration request, mapping $context.authorizer.subscriptionTier to a property in the request payload.
Under Lambda custom integration (non-proxy), the backend does not automatically receive the raw API Gateway request or authorizer context. Thus, explicit mapping is required.

Key Concept

API Gateway custom Lambda authorizers evaluate external tokens, return IAM policies targeting API Gateway execution ARNs, and provide context metadata that must be mapped to custom integrations.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic