A logistics company is exposing a shipment tracking API via an Amazon API Gateway REST API. The developer needs to secure the API to authenticate and authorize two categories of consumers:
1. Internal warehouse applications running on Amazon EC2 instances within the company's AWS account. These applications must be granted access using their IAM roles under the principle of least privilege.
2. Mobile client applications used by delivery drivers. These drivers authenticate against an external identity provider (IdP). The authorization process must validate custom claims in their security tokens to restrict access to specific geographical regions.
Which two configurations should the developer implement to secure the API Gateway endpoints for these consumers? (Select two.)
- Configure the API Gateway methods for the warehouse applications to use AWS_IAM authorization, and attach an IAM policy to the EC2 instances' instance profile role that allows the execute-api:Invoke action on the specific API resource ARN.Cevap
- Configure a Lambda Request Authorizer for the delivery driver methods. In the authorizer Lambda function, validate the token from the external IdP, extract the custom geographic claim, and generate an IAM policy that allows access to the requested API resource.Cevap
- CConfigure a Cognito User Pools Authorizer for the delivery driver methods, and set up a Cognito Identity Pool to exchange the external IdP tokens for credentials to be validated by the authorizer.
- DGenerate an API Gateway client certificate, associate it with the API Gateway stage, and install the certificate on the EC2 instances to authenticate client calls from the warehouse applications.
- EConfigure the delivery driver methods to use Lambda Proxy Integration. In the backend Lambda function, validate the external IdP token, parse the geographic claims, and return an IAM policy with Effect: Allow inside the proxy integration response payload.