A retail company is deploying a secure microservices-based application. A developer needs to expose a backend administrative endpoint via an Amazon API Gateway REST API. The API will be accessed exclusively by internal backend applications running on Amazon EC2 instances. The company requires that all requests be authenticated using AWS Signature Version 4 (SigV4) to enforce IAM-based access control. Which two options should the developer configure to secure this API under these requirements?
- Set the API Gateway method authorization type to AWS_IAM.Answer
- Attach an IAM policy to the EC2 instances' instance profile that grants execute-api:Invoke permissions on the API Gateway method resource.Answer
- CCreate an Amazon Cognito User Pool Authorizer and configure the EC2 instances to retrieve JWTs by authenticating directly with AWS STS.
- DImplement a Lambda Authorizer that parses the Authorization header, validates the AWS Signature Version 4 structure, and returns an IAM policy.
- EEnable Lambda proxy integration and inspect the event's requestContext.authorizer.claims object within the backend Lambda function to verify the IAM role.
Answer
To secure the API using AWS Signature Version 4 and IAM roles, the developer must set the method authorization type to AWS_IAM and grant the calling applications' EC2 instance profiles an IAM policy with execute-api:Invoke permissions.
The correct options are setting the authorization type to AWS_IAM and attaching an IAM policy with execute-api:Invoke permissions to the EC2 instances' instance profile. Setting the authorization to AWS_IAM utilizes API Gateway's native support for verifying Signature Version 4 headers. For the client application on EC2 to invoke this method, its IAM role must be granted the execute-api:Invoke permission.
Step-by-Step Solution
Key Concept
API Gateway authorization using AWS_IAM and Signature Version 4
Estimated Time:2m 0s