Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A developer is deploying a web application where the frontend authenticates users via a third-party Identity Provider (IdP) using OpenID Connect (OIDC). The frontend needs to make requests to a backend service exposed through an Amazon API Gateway HTTP API. The API must validate the incoming JSON Web Token (JWT) at the gateway layer before routing the request to backend AWS Lambda functions. The developer wants to implement this validation with the least amount of custom code and lowest latency. Which of the following configuration steps should the developer perform?

  1. Configure a built-in JWT authorizer on the HTTP API, providing the Issuer URL from the third-party IdP and the target Audience, and associate it with the API routes.Cevap
  2. B
    Create an Amazon Cognito Identity Pool to exchange the third-party JWT for temporary AWS IAM credentials, and configure IAM authorization on the HTTP API routes.
  3. C
    Create an Amazon API Gateway Lambda authorizer that parses the JWT, calls the third-party IdP's validation endpoint, and generates an IAM policy to allow the request.
  4. D
    Configure a Lambda proxy integration that passes the raw authorization header to the backend Lambda function, and validate the JWT within the application code of each backend function.

Cevap

Configure a built-in JWT authorizer on the HTTP API, providing the Issuer URL from the third-party IdP and the target Audience, and associate it with the API routes.
The correct answer is to configure a built-in JWT authorizer on the HTTP API. Amazon API Gateway HTTP APIs provide native support for JWT validation against OIDC-compliant Identity Providers. This built-in mechanism validates token signatures, expiration dates, and scopes without executing custom Lambda code, offering the lowest latency and overhead.

Adım Adım Çözüm

1
Select the API Gateway HTTP API and create a new Authorizer under the Security section.
A template for creating a new authorizer is displayed.
An authorizer is required at the gateway layer to intercept incoming requests and validate credentials before they reach the backend.
2
Choose JWT as the authorizer type, and configure the Identity Source (typically the Authorization header), Issuer URL (the third-party IdP's URL), and Audience (the client ID).
API Gateway automatically fetches the public keys (JWKS) from the OIDC issuer to validate incoming tokens.
This utilizes API Gateway's built-in OAuth 2.0 / OIDC capabilities to check token signatures and claims without custom code.
3
Attach the newly created JWT authorizer to the target HTTP API routes.
The HTTP API routes are now protected, and unauthorized requests are blocked directly at the gateway with a 401 Unauthorized status.
Associating the authorizer with specific routes ensures that only authenticated requests with valid tokens are forwarded to the backend integrations.

Anahtar Kavram

API Gateway HTTP APIs support built-in JWT authorizers that natively validate tokens from OpenID Connect (OIDC) compatible identity providers, eliminating the need for custom authorizer Lambda functions or IAM credential exchange.
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru