Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A developer is implementing security for a new Amazon API Gateway REST API. The API has two specific endpoints:

1. `POST /orders`: Used by a mobile application where users authenticate via Amazon Cognito User Pools.
2. `GET /dashboard/metrics`: Used by an administrative reporting service running on Amazon ECS tasks.

Which TWO actions should the developer take to configure authorization for these endpoints with the least operational overhead?

  1. Configure the `POST /orders` method to use an Amazon Cognito User Pools authorizer to validate incoming tokens.Cevap
  2. Configure the `GET /dashboard/metrics` method to use `AWS_IAM` authorization, and grant the ECS task role permission to invoke the API.Cevap
  3. C
    Configure the `POST /orders` method to use an Amazon Cognito Identity Pool authorizer to validate user identity.
  4. D
    Create a custom Lambda authorizer for the `POST /orders` method that parses and manually validates the JSON Web Tokens (JWTs) from the mobile clients.
  5. E
    Configure a Lambda custom integration for `GET /dashboard/metrics` that manually decodes and extracts IAM credentials from the raw request payload.

Cevap

Configure the POST /orders method to use an Amazon Cognito User Pools authorizer, and configure the GET /dashboard/metrics method to use AWS_IAM authorization while granting the ECS task role permission to invoke the API.
For the POST /orders endpoint, using a built-in Amazon Cognito User Pools authorizer is the recommended path because it requires zero custom code to validate Cognito-issued tokens. For the GET /dashboard/metrics endpoint, AWS_IAM authorization allows the administrative service running on ECS to leverage its IAM task role to sign requests with Signature Version 4, offering a secure, native method to control access without API keys or token exchange.

Adım Adım Çözüm

1
Analyze the requirement for the POST /orders endpoint to authenticate mobile users authenticated with Amazon Cognito User Pools.
Identify that API Gateway offers a native Cognito User Pools authorizer.
This authorizer directly validates JWT tokens from Cognito without custom code, minimizing operational overhead.
2
Analyze the requirement for the GET /dashboard/metrics endpoint to secure access for an administrative service on Amazon ECS.
Identify that the service uses an IAM role and API Gateway supports native AWS_IAM authorization.
AWS_IAM authorization allows callers to sign requests with SigV4 and enables native access control via IAM policies.
3
Configure permissions for the ECS task role to invoke the GET /dashboard/metrics endpoint.
Grant execute-api:Invoke permission on the API resource to the ECS task role.
This secures access based on the principle of least privilege.

Anahtar Kavram

API Gateway Security and Authorization using built-in Cognito and IAM authorizers
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru