Examkin

Soru

Zorluk: ZorAPI Gateway Security and Authorization

A developer is designing a secure REST API using Amazon API Gateway that will be consumed by external client applications. The clients authenticate against a third-party Identity Provider (IdP) that is not compatible with Amazon Cognito, receiving a custom JSON Web Token (JWT) that includes specific scopes in the payload. The REST API must authorize access to resources based on these scopes and forward the verified user identity metadata to a backend Lambda function using a Lambda proxy integration. The developer wants to implement a solution that minimizes both authorization latency and cost. Which configuration should the developer implement to meet these requirements?

  1. A
    Configure the API Gateway integration to use a Lambda custom integration with a request mapping template that forwards the custom JWT. Perform the JWT validation and policy evaluation directly inside the backend Lambda function, caching the validation results in an Amazon ElastiCache cluster to minimize authorization latency on subsequent requests.
  2. Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.Cevap
  3. C
    Configure a Cognito User Pool authorizer in API Gateway, and link it to an Amazon Cognito Identity Pool that federates with the third-party Identity Provider. Retrieve the custom scopes and user identity metadata from the requestContext.authorizer.claims object in the backend Lambda function, and configure API Gateway caching on the client's IAM role.
  4. D
    Configure a Cognito User Pool authorizer in API Gateway to validate the custom JWT. Set the authorizer's Identity Source to the Authorization header, and configure a custom Lambda integration mapping template to extract the third-party JWT and exchange it for an IAM policy before executing the backend Lambda function.

Cevap

Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.
The correct solution uses an API Gateway Lambda authorizer to validate the third-party JWT. Because the token is not issued by Amazon Cognito, a built-in Cognito authorizer cannot be used. By setting an Identity Source (such as the Authorization header), API Gateway caches the generated IAM policy, preventing downstream invocations of the authorizer Lambda function on subsequent calls with the same token. Additionally, return values in the context object from the authorizer are forwarded to the backend Lambda function under requestContext.authorizer, satisfying the requirement to pass user metadata securely while keeping backend processing optimized.

Adım Adım Çözüm

1
Create and deploy a Lambda authorizer function that receives the third-party JWT, validates its cryptographic signature against the IdP's public keys, and inspects the payload claims for valid scopes.
The Lambda function is ready to return an IAM policy document and a custom context object containing user metadata.
API Gateway requires a custom Lambda authorizer to inspect and validate third-party tokens since built-in Cognito authorizers only validate Cognito-issued tokens.
2
Configure the API Gateway REST API to use the Lambda authorizer, set the authorization caching TTL, and specify the Identity Source (such as method.request.header.Authorization).
API Gateway caches the policy document returned by the authorizer for matching tokens, avoiding repeated invocations of the authorizer function.
Caching reduces API latency and reduces the cost of running the authorizer Lambda function on every API request.
3
Map the required user identity claims to the context object returned by the Lambda authorizer, and use Lambda Proxy Integration for the backend integration.
The backend Lambda function receives the mapped metadata in the requestContext.authorizer object of the incoming event.
Using the context object allows passing validated client metadata to the backend Lambda function securely without requiring the backend function to parse or re-validate the token.

Anahtar Kavram

Using API Gateway Lambda authorizers to validate third-party JSON Web Tokens (JWTs) and caching the authorization policy response to minimize backend invocations.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru