Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a serverless web application that utilizes Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for backend services. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them. The solution must validate the JSON Web Tokens (JWTs) provided by the client with the least amount of custom code and lowest operational overhead. Which solution should the developer implement to meet these requirements?

  1. A
    Configure an Amazon Cognito Identity Pool to exchange the User Pool token for temporary AWS credentials, and secure the API Gateway REST API using IAM authorization.
  2. B
    Create a custom API Gateway Lambda Authorizer that fetches the JSON Web Key Set (JWKS), validates the incoming token signature, and returns an IAM policy.
  3. Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.Answer
  4. D
    Set up an API Gateway Lambda Authorizer that checks the user's group membership by making a synchronous DescribeUser API call to the User Pool on every request.

Answer

Configure an API Gateway Cognito User Pool Authorizer to directly validate the identity token passed in the request header.
Configuring an API Gateway Cognito User Pool Authorizer is the most efficient approach because it is a built-in feature of API Gateway. It automatically validates the identity token passed in the request header against the configured Cognito User Pool client, requiring no custom Lambda function or custom code validation.

Step-by-Step Solution

1
Identify the primary requirement
The goal is to authorize API Gateway REST API requests using JWTs issued by Amazon Cognito User Pools with minimal custom code and latency.
This establishes the constraints of the system (no custom code, low overhead).
2
Evaluate the native capabilities of API Gateway
API Gateway features a built-in Cognito User Pool authorizer.
The built-in authorizer natively processes incoming authorization headers containing Cognito tokens without requiring custom Lambda functions or IAM credential exchanges.
3
Select the optimal configuration
Configure the Cognito Authorizer on the API Gateway method and set the identity source to the Authorization header.
This configuration meets all criteria by delegating JWT validation directly to API Gateway, requiring zero code and incurring no additional execution overhead.

Key Concept

Amazon API Gateway Cognito User Pool Authorizers
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic