Examkin

Question

Difficulty: EasyAPI Gateway Security and Authorization

A developer is building a client-facing web application and needs to restrict access to a REST API hosted on Amazon API Gateway. The application's users will sign in using an Amazon Cognito User Pool. The developer wants to secure the API Gateway endpoints by validating the identity tokens issued to users upon login, with the least amount of development effort and custom code. Which authorization method should the developer configure on the API Gateway resources?

  1. Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.Answer
  2. B
    Create a custom Lambda authorizer to parse and validate the JSON Web Token (JWT) issued by the User Pool.
  3. C
    Configure an Amazon Cognito Identity Pool authorizer to directly authenticate the API Gateway request.
  4. D
    Configure a Lambda proxy integration to manually inspect the user credentials in the incoming request body.

Answer

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.
Using the built-in Amazon Cognito User Pools authorizer is the most efficient method because Amazon API Gateway natively validates tokens issued by Amazon Cognito. This eliminates the need to develop, test, and maintain custom Lambda authorizer code, which minimizes development effort and operational overhead.

Step-by-Step Solution

1
Identify the authentication provider and the development constraints.
The application uses Amazon Cognito User Pools for user sign-in and token issuance, and requires token validation with the least development effort.
This establishes that we need a solution that integrates natively with Cognito User Pools tokens without custom code.
2
Evaluate API Gateway security integration types.
Amazon API Gateway offers a built-in Cognito User Pools authorizer that automatically validates the signature and expiration of Cognito JSON Web Tokens (JWTs).
Choosing a native authorizer avoids the need to write and maintain custom validation logic inside a Lambda function.

Key Concept

Built-in Cognito User Pools Authorizer in Amazon API Gateway
Rate this question

Topics

API Gateway Security and Authorization

More questions from this topic