Examkin

Question

Difficulty: HardAPI Gateway Security and Authorization

A developer is securing a REST API hosted on Amazon API Gateway for a serverless application. External third-party partner systems must programmatically access this API using a machine-to-machine authentication flow. The partner systems do not have AWS accounts and support only the OAuth 2.0 Client Credentials grant flow. The developer wants to enforce authorization at the API Gateway layer with minimal custom code and low maintenance overhead. Which configuration should the developer implement?

  1. Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.Answer
  2. B
    Configure a Cognito Identity Pool to authenticate the partner systems using anonymous guest access. Grant the partner systems temporary AWS credentials to sign their requests using AWS Signature Version 4 (SigV4), and enable IAM authorization on the API Gateway methods.
  3. C
    Configure a Cognito User Pool with a resource server and client credentials. In API Gateway, create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from Cognito, decodes and validates the signature of the incoming JWT access token, and returns an IAM policy. Configure the API method to use this Lambda authorizer.
  4. D
    Enable Lambda Proxy integration on API Gateway to forward the requests to a backend Lambda function. Within the backend Lambda function code, parse the Authorization header, extract the access token, and perform custom validation against client client_id and client_secret pairs stored in AWS Systems Manager Parameter Store.

Answer

Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.
The correct configuration leverages Amazon Cognito User Pools with a Resource Server to support the OAuth 2.0 Client Credentials flow. External partner systems can obtain an access token and pass it to API Gateway. The built-in Cognito User Pool authorizer natively validates these access tokens and checks for the required custom scopes. This requires zero custom code and operates at the API Gateway layer, minimizing maintenance overhead and execution cost.

Step-by-Step Solution

1
Set up the Cognito User Pool acting as an OAuth 2.0 authorization server.
A Resource Server is defined in the Cognito User Pool with custom scopes representing API permissions. An App Client is created with the client credentials flow enabled.
This allows third-party clients to request OAuth 2.0 access tokens by authenticating directly with the Cognito token endpoint using client credentials, without needing AWS accounts or user logins.
2
Configure the Cognito Authorizer on Amazon API Gateway.
API Gateway is configured with a built-in Cognito User Pool authorizer pointing to the user pool.
This enables API Gateway to automatically fetch the JSON Web Key Set (JWKS) from Cognito, verify the token signatures, and extract the claims at the gateway level.
3
Apply the authorizer and custom scopes to the API methods.
The target API methods are associated with the Cognito Authorizer and the required custom scopes from the resource server.
This enforces that only requests presenting valid access tokens with the required scopes are authorized, filtering out unauthorized requests before they reach the backend integrations.

Key Concept

Using built-in Cognito User Pool authorizers with OAuth 2.0 Client Credentials flow for machine-to-machine API authorization.
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic