Examkin

Soru

Zorluk: ZorAPI Gateway Security and Authorization

A software-as-a-service (SaaS) provider is exposing a REST API hosted on Amazon API Gateway to business partners. The partners need to authenticate using their own enterprise SAML 2.0 Identity Providers (IdPs). The provider wants to minimize custom authorization code and directly validate partner users before allowing them to invoke backend services. Which two configuration steps must the developer perform to meet these requirements?

  1. Configure the external SAML 2.0 Identity Provider (IdP) as a federated provider in an Amazon Cognito User Pool.Cevap
  2. Create an Amazon API Gateway authorizer of type Cognito User Pool, reference the User Pool, and define the identity source header containing the JSON Web Token (JWT).Cevap
  3. C
    Configure the external SAML 2.0 Identity Provider (IdP) as an authentication provider in an Amazon Cognito Identity Pool, and create an API Gateway Cognito authorizer pointing directly to the Identity Pool.
  4. D
    Develop a Custom Lambda authorizer that intercepts the SAML token, executes the AssumeRoleWithSAML API call on AWS STS, and uses the resulting temporary credentials to call the backend service.
  5. E
    Develop a Custom Lambda authorizer that validates the token and returns a standardized Lambda proxy integration response containing statusCode and body keys to authorize the request.

Cevap

Configure the external SAML 2.0 Identity Provider (IdP) as a federated provider in an Amazon Cognito User Pool, and create an Amazon API Gateway authorizer of type Cognito User Pool, reference the User Pool, and define the identity source header containing the JSON Web Token (JWT).
To authenticate external SAML 2.0 Identity Providers with Amazon API Gateway while minimizing custom code, the developer should configure the SAML IdP as a federated identity provider in an Amazon Cognito User Pool. The client application will authenticate with the User Pool and receive a JSON Web Token (JWT). The developer should then create a built-in Cognito User Pool Authorizer in API Gateway. This authorizer automatically validates the JWT passed in the specified Identity Source header without requiring any custom Lambda code.

Adım Adım Çözüm

1
Configure SAML 2.0 federation in an Amazon Cognito User Pool.
External partner users can authenticate with their own IdP, and Cognito User Pools will issue standard OIDC JSON Web Tokens (JWTs).
This establishes federation and manages user sessions without requiring custom login directories or credentials storage.
2
Configure a Cognito User Pool Authorizer on the REST API methods.
API Gateway automatically verifies the JWT signature and claims for each API call against the Cognito User Pool configuration.
This fulfills the requirement to validate user authenticity at the API Gateway edge with zero custom code.

Anahtar Kavram

Integrating Amazon API Gateway with Amazon Cognito User Pools allows federated authentication (like SAML 2.0) to be easily validated at the API edge. The built-in Cognito Authorizer handles signature verification and token validation automatically, avoiding the need for custom Lambda authorizers or manual STS credential exchange.
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru