Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A developer is building a serverless backend for a mobile application. The APIs are exposed via an Amazon API Gateway REST API. The application uses an Amazon Cognito User Pool for user authentication. The developer needs to secure the API Gateway methods so that only authenticated users can access them. Additionally, the backend Lambda function must access the authenticated user's custom attribute, `custom:department`, to perform fine-grained data authorization. The client application is configured to pass the user's ID token in the HTTP `Authorization` header.

Which two configuration steps must the developer perform to meet these requirements?

  1. Configure an API Gateway Cognito User Pool authorizer that references the User Pool, and set the Token Source to `method.request.header.Authorization`.Answer
  2. Configure the API Gateway method to use Lambda proxy integration, and access the custom attributes in the backend Lambda function via the `event.requestContext.authorizer.claims` object.Answer
  3. C
    Configure an API Gateway Lambda authorizer that downloads the JSON Web Key Set (JWKS) to manually verify the ID token signature and extract the claims.
  4. D
    Configure a Cognito Identity Pool to authenticate users, exchange their ID token for temporary AWS IAM credentials, and enable `AWS_IAM` authorization on the API Gateway method.
  5. E
    Configure the API Gateway method to use Lambda custom integration, and create an integration mapping template to map the custom attributes using `context.authorizer.claims`.

Answer

Configure an API Gateway Cognito User Pool authorizer pointing to the User Pool with the appropriate token source, and configure the API Gateway method to use Lambda proxy integration to read the custom attribute claims under the request event context.
To secure the API Gateway REST API with Cognito User Pool users, the developer should configure a native API Gateway Cognito User Pool authorizer. This authorizer automatically validates the incoming JSON Web Token (JWT) signature and expiration. By specifying `method.request.header.Authorization` as the Token Source (or Identity Source), API Gateway expects the client to pass the token in that header. In addition, when the API Gateway method is configured with Lambda proxy integration, API Gateway automatically passes the validated token's claims (including custom user attributes) to the backend Lambda function. The function can access these claims directly in the event object under the `event.requestContext.authorizer.claims` path, which contains the `custom:department` claim.

Step-by-Step Solution

1
Configure an API Gateway Cognito User Pool authorizer.
API Gateway will natively validate incoming JSON Web Tokens (JWTs) from the specified User Pool using the `Authorization` header as the token source.
This eliminates the need to write custom validation logic in a Lambda authorizer, minimizing complexity and latency.
2
Configure the API Gateway method to use Lambda proxy integration.
The full request context, including authorization metadata, is automatically forwarded to the backend Lambda function.
Lambda proxy integration simplifies the interface, bypassing the need for manual integration mapping templates.
3
Access user attributes inside the Lambda function.
The backend code can directly read the claims from `event.requestContext.authorizer.claims['custom:department']`.
Cognito User Pool authorizers automatically populate user claims in the request context under the authorizer claims dictionary.

Key Concept

Securing API Gateway using Cognito User Pool Authorizers and passing identity context to a backend Lambda function using Lambda Proxy Integration.
Estimated Time:3m 0s
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic