Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A logistics company is designing a REST API in Amazon API Gateway to allow partner clients to retrieve shipment data. Partners authenticate against an external OAuth 2.0 Identity Provider (IdP) and receive a JWT access token containing custom scopes like `shipments:read`. The developer wants to authenticate the tokens and enforce access control using these custom scopes at the API Gateway level with minimal custom code. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

  1. Create and configure an Amazon Cognito User Pool with the external IdP as a federated provider, then create a Cognito User Pool authorizer in API Gateway.Cevap
  2. Associate the Cognito authorizer with the API method, and specify the required custom scopes in the OAuth Scopes field of the Method Request configuration.Cevap
  3. C
    Create an Amazon Cognito Identity Pool to authenticate the partners, exchange the JWT for temporary AWS credentials, and configure an IAM authorizer on the API methods.
  4. D
    Create a custom Lambda authorizer that calls the Cognito Identity Pool API to validate the custom scopes and return an IAM policy.
  5. E
    Configure the API Gateway integration type as a Lambda proxy integration to automatically forward the JWT payload, allowing the backend Lambda function to perform signature verification.

Cevap

To secure the REST API with minimal custom code, the developer should create and configure an Amazon Cognito User Pool federated with the external IdP, set up a Cognito User Pool authorizer, and then specify the required custom scopes in the Method Request configuration.
The correct options involve configuring an Amazon Cognito User Pool federated with the external Identity Provider and creating a Cognito User Pool authorizer. This allows API Gateway to handle JWT signature validation natively. By configuring the method request with the required OAuth scopes, API Gateway natively verifies that the token contains the matching scope claims, preventing unauthorized traffic from reaching the backend with zero custom code.

Adım Adım Çözüm

1
Integrate the external Identity Provider with Amazon Cognito.
Amazon Cognito User Pool is created and configured with the external IdP as a federated provider, allowing API Gateway to recognize the external tokens via a Cognito User Pool authorizer.
This establishes trust and allows API Gateway to natively validate the JWT token structure and signature without custom validation code.
2
Configure the Cognito User Pool authorizer in API Gateway.
A Cognito User Pool authorizer is added to the API Gateway REST API and linked to the created Cognito User Pool.
This registers the authorizer with the API Gateway deployment so it can be associated with individual methods.
3
Enable scope validation on the API methods.
The Cognito authorizer is associated with the target method, and custom scopes (such as 'shipments:read') are added to the OAuth Scopes field in the Method Request configuration.
This configures API Gateway to automatically inspect the incoming token for the required scopes and reject unauthorized requests before they reach the backend.

Anahtar Kavram

API Gateway integration with Amazon Cognito User Pools for federated authentication and native OAuth scope validation.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru