Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A developer is designing a secure serverless backend where a single-page application (SPA) needs to access a REST API hosted on Amazon API Gateway. Users authenticate using Amazon Cognito User Pools. The developer needs to implement authorization such that standard users can only invoke the GET methods on /items resources, while administrative users (members of the 'Admins' Cognito group) can invoke any method on /items and /admin resources. Which two configuration steps should the developer perform to implement this authorization model?

  1. Enable AWS_IAM authorization on the API Gateway resources. Integrate the Amazon Cognito User Pool with an Amazon Cognito Identity Pool, configure group-based role mapping to associate the 'Admins' group with a high-privilege IAM role, and have the client application sign API requests using temporary AWS credentials via Signature Version 4.Answer
  2. Configure an API Gateway Lambda Authorizer. In the authorizer function, verify the signature of the JSON Web Token (JWT) provided by the Cognito User Pool, inspect the 'cognito:groups' claim in the payload, and dynamically generate an IAM policy that allows or denies access to the specific resource paths.Answer
  3. C
    Configure a Cognito User Pool Authorizer on the API Gateway resources. In the API Gateway console, use the OAuth Scopes configuration to map the Cognito user groups directly to the corresponding HTTP methods and resource paths of the REST API.
  4. D
    Configure an Amazon Cognito Identity Pool as the API Gateway Authorizer. Send the Cognito ID token in the authorization header, and configure API Gateway to automatically map the token's claims to IAM policy permissions on the backend integration.
  5. E
    Enable AWS_IAM authorization on the API Gateway. Configure the API to use a Lambda Proxy integration, and write logic inside the backend Lambda integration function to query the Amazon Cognito User Pool to retrieve user groups and return a 403 Forbidden status code if unauthorized.

Answer

To implement group-based authorization on API Gateway with Cognito User Pools, the developer can either use AWS_IAM authorization with Cognito Identity Pools and group-to-role mapping, or implement a Lambda Authorizer that inspects the 'cognito:groups' claim in the JWT and dynamically generates an IAM policy.
The correct options represent the two main architectures for implementing group-based access control in API Gateway. Using AWS_IAM authorization with Cognito Identity Pools maps User Pool groups to distinct IAM roles, letting API Gateway natively enforce authorization via SigV4 signed requests. Using a Lambda Authorizer allows developers to decode the JWT, inspect the 'cognito:groups' claim, and dynamically return an IAM policy allowing or denying access to specific routes.

Step-by-Step Solution

1
Identify the authorization requirements.
The system needs to restrict API access based on Cognito groups, which requires mapping groups to specific API paths and methods.
This establishes the scope and logic needed for the authorization policy.
2
Evaluate the AWS_IAM and Cognito Identity Pool approach.
By mapping user groups to different IAM roles via Cognito Identity Pools, the client can sign requests with SigV4, allowing API Gateway to evaluate permissions natively via IAM policies.
This offloads authorization logic to native AWS features, minimizing custom development.
3
Evaluate the custom Lambda Authorizer approach.
A Lambda Authorizer can verify the Cognito JWT signature, parse the 'cognito:groups' claim, and dynamically generate an IAM policy based on group membership.
This is standard when the client uses bearer tokens and avoids SigV4 request signing.

Key Concept

Fine-grained API Gateway authorization using Cognito groups, IAM policies, and Lambda Authorizers
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic