Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A developer is building a partner portal API using an Amazon API Gateway REST API. External partner organizations will access this API using JSON Web Tokens (JWTs) issued by their own external OAuth 2.0 Identity Provider (IdP). The developer needs to secure the API so that requests are authorized only if the JWT is valid and contains a specific custom scope.

Which approach should the developer use to meet these security requirements with the least administrative and operational overhead?

  1. Configure a Lambda authorizer on the REST API to validate the incoming JWT signature, parse the custom scopes, and return an IAM policy to API Gateway.Cevap
  2. B
    Configure an Amazon Cognito User Pools authorizer on the REST API, pointing the Token Source to the external Identity Provider's token verification endpoint.
  3. C
    Create an Amazon Cognito Identity Pool to federate the external Identity Provider, configure the REST API to use IAM authorization, and require partner clients to sign their HTTP requests with Signature Version 4.
  4. D
    Configure a Lambda proxy integration for the REST API methods, and implement custom code within the backend Lambda function to validate the JWT and return HTTP 401 Unauthorized for invalid tokens.

Cevap

Configure a Lambda authorizer on the REST API to validate the incoming JWT signature, parse the custom scopes, and return an IAM policy to API Gateway.
The correct approach is to configure a Lambda authorizer on the REST API. Since API Gateway REST APIs do not have a native JWT authorizer for third-party token validation (unlike HTTP APIs), a Lambda authorizer is required to run custom logic. The Lambda authorizer receives the bearer token, validates its signature against the external Identity Provider's public keys, checks the custom scopes, and returns an IAM policy that allows or denies access. This keeps the authorization logic at the API Gateway tier, protecting the backend.

Adım Adım Çözüm

1
Analyze the requirements for authorization: REST API, external OAuth 2.0 IdP issuing JWTs, custom scope check, and minimum operational overhead.
The solution must validate third-party JWT tokens at the API Gateway level before hitting the backend integration.
Securing the API at the gateway level prevents unauthorized traffic from executing backend code and consuming resources.
2
Evaluate the native authorization options in API Gateway REST APIs for third-party JWTs.
Amazon API Gateway REST APIs do not natively support third-party JWT validation (unlike HTTP APIs which support JWT authorizers). Cognito User Pool authorizers only accept tokens generated by Cognito User Pools.
This rules out native Cognito User Pool authorizers for direct validation of external JWTs.
3
Select the appropriate custom authorization mechanism.
A Lambda authorizer (custom authorizer) is the standard and recommended way to validate external JWTs in a REST API. The Lambda function verifies the token signature against the IdP's JWKS (JSON Web Key Set), checks the custom scopes, and generates an IAM policy specifying whether the client is allowed to call the API method.
This achieves security verification at the gateway boundary with minimal administrative overhead.

Anahtar Kavram

API Gateway Lambda Authorizers for Third-Party JWT Validation
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru