A retail company has developed a mobile application where users authenticate using Amazon Cognito User Pools. The backend services are exposed through an Amazon API Gateway REST API. The company needs to restrict API access so that only authenticated users with a valid JSON Web Token (JWT) can invoke the API methods. The developer wants to implement this validation with the lowest development effort and without writing any custom authorization code. Which configuration should the developer choose to secure the API?
- Configure a built-in API Gateway Cognito authorizer that directly validates the incoming user pool tokens.Cevap
- BCreate a custom Lambda authorizer that decodes, verifies, and validates the Cognito JSON Web Token (JWT) on every request.
- CSet up an Amazon Cognito Identity Pool to exchange user tokens for temporary AWS credentials and secure the API using IAM authorization.
- DEnable a Lambda proxy integration and perform token decoding and validation manually inside the backend Lambda function.
Cevap
Configure a built-in API Gateway Cognito authorizer that directly validates the incoming user pool tokens.
Configuring a built-in API Gateway Cognito authorizer is the most operationally efficient solution. It natively integrates API Gateway with Amazon Cognito User Pools, allowing API Gateway to automatically validate the incoming JWT signature, expiration, and client ID. This requires zero custom code and incurs no additional Lambda execution costs for authorization.
Adım Adım Çözüm
Anahtar Kavram
API Gateway Cognito User Pool Authorizer