Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A developer is securing a REST API in Amazon API Gateway for a social media application. Users authenticate via a web frontend using Amazon Cognito. The developer needs to restrict access to the API Gateway resources to authenticated users only and pass the user's username and email to the backend AWS Lambda function for auditing. The solution must minimize custom code and use built-in API Gateway features. Which two steps must the developer perform to meet these requirements? (Select TWO.)

  1. Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.Cevap
  2. In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.Cevap
  3. C
    Configure an API Gateway Cognito Identity Pool Authorizer and associate it with the API methods.
  4. D
    Create an API Gateway Lambda Custom Authorizer to validate the JWT and return an IAM policy allowing the request.
  5. E
    Configure a Lambda Custom Integration (non-proxy) and parse the Authorization header inside the Lambda function using a mapping template.

Cevap

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods, and extract the user's identity details from the event.requestContext.authorizer.claims context object in the backend Lambda function.
To secure the API with minimal custom code, the developer should configure an API Gateway Cognito User Pool Authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) issued by Cognito User Pools. Once validated, API Gateway automatically propagates the user's token claims (including email and username) to the backend integration, where they can be extracted directly from the requestContext.authorizer.claims context variable inside the Lambda function.

Adım Adım Çözüm

1
Select the built-in Cognito User Pool Authorizer in API Gateway.
API Gateway is configured to automatically validate the JWT tokens sent by the client frontend.
This avoids writing custom validation code and utilizes AWS managed capabilities.
2
Associate the authorizer with the specific HTTP/REST methods on the API Gateway resource.
Unauthenticated requests are blocked at the gateway level with a 401 Unauthorized response, protecting the backend.
This secures the endpoints before requests reach the backend Lambda function.
3
Access the user claims within the Lambda handler using the integration event object.
The Lambda function receives the username and email in the event object without performing additional decoding or verification.
API Gateway automatically populates the claims under requestContext.authorizer.claims when the Cognito authorizer successfully validates the token.

Anahtar Kavram

API Gateway Cognito User Pools Integration
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru