A developer is building a fitness tracking mobile application that uses an Amazon API Gateway REST API backed by AWS Lambda. The developer needs to secure the API so that only authenticated users can access their workout logs. The authentication system must use Amazon Cognito User Pools, and the API Gateway should directly validate the JSON Web Tokens (JWT) sent in the HTTP Authorization header without calling custom validation code. Which two configuration steps must the developer perform to implement this security control?
- Create an Amazon API Gateway authorizer of type Cognito, referencing the Cognito User Pool ID and setting the token source header to Authorization.Cevap
- Configure the REST API's resource methods to use the newly created Cognito authorizer and redeploy the API.Cevap
- CCreate an Amazon Cognito Identity Pool, configure it as the API Gateway authorizer, and pass the identity pool ID in the request header.
- DBuild a Lambda custom authorizer that invokes Cognito API calls to manually verify the JWT for each incoming API request.
- EEnable API Gateway Lambda Proxy integration and implement token validation logic inside the backend Lambda function.
Cevap
To secure the API using Cognito User Pools directly at the API Gateway layer, the developer must create a Cognito authorizer associated with the Cognito User Pool ID and configure the token source header to Authorization. Additionally, they must configure the API methods to use this authorizer and deploy the API.
The correct actions are to create an API Gateway authorizer of type Cognito configured with the Cognito User Pool ID, and to bind this authorizer to the API's resource methods while deploying the API. This enables built-in validation of user pool JWT tokens at the API Gateway layer.
Adım Adım Çözüm
Anahtar Kavram
API Gateway Cognito User Pool Authorizer