Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A developer is building a mobile application where users authenticate via Amazon Cognito. The backend services are exposed through an Amazon API Gateway REST API. The developer needs to restrict access to the API endpoints so that only successfully authenticated users from a specific Amazon Cognito User Pool can call the API. The mobile client sends the id_token in the Authorization header. Which configuration represents the most operationally efficient and secure solution?

  1. Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.Cevap
  2. B
    Create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from the Cognito User Pool, validates the signature of the incoming token, and returns an IAM policy.
  3. C
    Configure an API Gateway Cognito Authorizer pointing to an Amazon Cognito Identity Pool, mapping the token to temporary AWS credentials to authorize the requests.
  4. D
    Configure a Lambda Proxy Integration for the API methods, and implement custom code within the backend Lambda function to inspect the Authorization header and validate the token.

Cevap

Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.
The correct answer configures a native API Gateway Cognito Authorizer referencing the User Pool. This approach allows API Gateway to automatically and natively validate token signatures, audiences, and expiration, offloading the security checks from the backend application code and saving operational costs.

Adım Adım Çözüm

1
Identify the authentication source and token format.
Amazon Cognito User Pool id_token (JWT).
Knowing that users authenticate via User Pools and produce standard JWTs helps choose the appropriate native integration.
2
Select the API Gateway authorization type that natively handles Cognito JWT verification.
API Gateway Cognito Authorizer.
A Cognito Authorizer allows API Gateway to directly validate token signatures, expiration, and audiences without invoking custom code or Lambda functions.
3
Configure the token source in API Gateway.
Set token source to the 'Authorization' header.
This instructs API Gateway to extract the id_token from the Authorization header of the incoming HTTP request.

Anahtar Kavram

API Gateway Cognito Authorizer
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru