Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

An enterprise retail application exposes catalog and inventory management endpoints via an Amazon API Gateway REST API. The system has two distinct integration requirements:

1. A customer-facing portal where users authenticate using external Google Workspace accounts.
2. An automated background synchronization service running on Amazon ECS Fargate that updates inventory levels.

The developer needs to secure both sets of endpoints using native AWS mechanisms to minimize custom code and maintenance.

Which TWO configuration steps should the developer perform to secure these endpoints?

  1. Configure the customer-facing endpoints to use an Amazon Cognito User Pool authorizer, allowing the API to automatically validate the JSON Web Tokens (JWT) generated after Google Workspace federation.Cevap
  2. Enable AWS_IAM authorization on the inventory synchronization endpoints, and configure the ECS Fargate tasks with an IAM Task Role that has permissions to execute the API using Signature Version 4 signing.Cevap
  3. C
    Configure the customer-facing endpoints to use an Amazon Cognito Identity Pool authorizer, enabling users to present their Google Workspace credentials directly to API Gateway for authentication.
  4. D
    Build a custom Lambda authorizer for the inventory synchronization endpoints that validates the ECS Fargate container credentials by invoking the AWS Security Token Service (STS) on each API call.
  5. E
    Implement a Lambda proxy integration on the inventory synchronization endpoints, routing the requests to a backend Lambda function that manually parses and validates the AWS Signature Version 4 signature in the request headers.

Cevap

Configure the customer-facing endpoints to use an Amazon Cognito User Pool authorizer, and enable AWS_IAM authorization on the inventory synchronization endpoints while assigning an IAM Task Role to the ECS Fargate tasks.
For external user authentication, Amazon Cognito User Pools provide a native authorizer in API Gateway that validates OIDC-compliant JWT tokens (such as from Google Workspace) without requiring custom Lambda code. For AWS service-to-service communication, enabling AWS_IAM authorization allows API Gateway to natively verify Signature Version 4 (SigV4) signatures generated by Fargate tasks using their IAM Task Roles, enforcing least-privilege access.

Adım Adım Çözüm

1
Determine authorization for external federated users.
Identify that Google Workspace acts as the identity provider (IdP). Amazon Cognito User Pools handle federation and issue JWTs. API Gateway natively validates these JWTs via a Cognito User Pools authorizer.
This offloads identity management and token verification to AWS native services, avoiding custom validation code.
2
Determine authorization for internal AWS compute resources.
Identify that Amazon ECS Fargate runs within AWS. Secure service-to-service authentication is natively supported using AWS_IAM authorization and Signature Version 4 (SigV4) signing via an IAM Task Role.
This follows the security principle of least privilege and avoids managing static keys or custom authorizer logic.

Anahtar Kavram

API Gateway natively supports Amazon Cognito User Pools authorizers for user-based JWT validation and AWS_IAM authorization for service-to-service SigV4 request verification.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru