Examkin

Question

Difficulty: MediumAPI Gateway Security and Authorization

A developer is designing a serverless backend where a single-page application (SPA) needs to access a private REST API hosted on Amazon API Gateway. The developer wants to authenticate users using an Amazon Cognito User Pool and grant them access to the API Gateway endpoints. The client application needs to acquire a JSON Web Token (JWT) after user login and pass it to API Gateway for validation. Which configuration should the developer implement in API Gateway to authorize these requests with the least administrative effort and cost?

  1. Create a Cognito User Pool Authorizer in API Gateway, and configure the API method to use this authorizer while specifying the Identity Source header.Answer
  2. B
    Create a custom Lambda authorizer that receives the JWT, validates it using the Cognito public JSON Web Key Set (JWKS), and returns an IAM policy allowing the method execution.
  3. C
    Create an Amazon Cognito Identity Pool, configure API Gateway to use AWS_IAM authorization, and configure the client application to directly pass the Cognito Identity Pool ID in the request header.
  4. D
    Enable Lambda Proxy integration for the integration request, and parse the Cognito JWT inside the backend Lambda function to perform authorization checks before processing the business logic.

Answer

Create a Cognito User Pool Authorizer in API Gateway, and configure the API method to use this authorizer while specifying the Identity Source header.
The correct option is to create a Cognito User Pool Authorizer in API Gateway and configure the API method to use this authorizer. This option represents the native integration designed specifically for Amazon Cognito User Pools. It automatically validates incoming JWT signatures, expiration, and audiences at the API Gateway edge, requiring zero custom code and adding no extra execution costs for custom Lambda authorizers.

Step-by-Step Solution

1
Identify the authentication source and token type.
The authentication source is an Amazon Cognito User Pool, and the token is a standard JWT.
This determines which authorization mechanisms are natively supported by API Gateway.
2
Evaluate native API Gateway features against custom solutions.
API Gateway offers a built-in Cognito User Pool Authorizer that handles JWT validation natively.
A native feature reduces administrative overhead, eliminates the need for custom Lambda authorizers, and minimizes costs.
3
Configure the method execution settings.
Bind the API method to the Cognito User Pool Authorizer and define the header where the JWT will be supplied.
This ensures the API Gateway enforces authorization at the entry point prior to routing requests downstream.

Key Concept

API Gateway Cognito User Pool Authorizer
Estimated Time:1m 30s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic