Examkin

Question

Difficulty: MediumAmazon Cognito Authentication and Authorization

A developer is building a web application that uses Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for the backend. The developer needs to restrict access to a specific API resource so that only users who have a custom user attribute `custom:membership` set to `Gold` can access it. The client application must be able to call the API by passing the Cognito ID token in the `Authorization` header, without having to sign the requests using AWS Signature Version 4. Which solution should the developer implement to meet these requirements?

  1. Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.Answer
  2. B
    Configure an API Gateway Cognito User Pool authorizer and specify the custom membership attribute as an authorization scope on the API Gateway method request.
  3. C
    Use an Amazon Cognito Identity Pool to federate authentication, map the custom membership claim to an IAM role, and configure the API Gateway method to use AWS_IAM authorization.
  4. D
    Create a custom API Gateway Lambda authorizer that calls the Cognito AdminGetUser API using the AWS SDK to retrieve the user's attributes and check the custom membership value on each request.

Answer

Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.
The correct solution uses a custom API Gateway Lambda authorizer to decode the Cognito ID token, verify its signature, and inspect the custom membership claim value. Because Cognito ID tokens are JSON Web Tokens (JWTs) that carry custom user attributes in their payload, the Lambda authorizer can perform this check offline without calling Cognito APIs, and then return the appropriate IAM policy to allow or deny access. This achieves the desired authorization logic without requiring the client to perform Signature Version 4 signing.

Step-by-Step Solution

1
Select the API Gateway Lambda authorizer pattern over the built-in Cognito User Pool authorizer.
Enables inspection of custom claims such as custom attributes, which the built-in Cognito authorizer cannot evaluate for custom routing logic.
Built-in Cognito authorizers are limited to token validation and scope checks, making them unsuitable for fine-grained authorization based on custom attributes.
2
Configure the Lambda authorizer to decode and validate the token locally.
Ensures the token is authentic by checking the signature against Cognito's public keys, verifying expiration, and extracting user attributes directly from the payload.
Decoding the token locally prevents slow and rate-limited API calls (like AdminGetUser) to Cognito, optimizing performance and avoiding throttling.
3
Generate and return an IAM policy based on the custom membership claim value.
Returns an IAM Allow policy if the claim value is Gold, or Deny policy otherwise.
API Gateway uses the returned IAM policy to permit or block access to the backend integration.

Key Concept

Fine-grained API Gateway authorization using Cognito ID token claims with a custom Lambda Authorizer.
Rate this question

Topics

Amazon Cognito Authentication and Authorization

More questions from this topic