Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A developer is implementing authorization for an Amazon API Gateway REST API. The API serves as the backend for a web application where users register and log in directly using Amazon Cognito. The developer needs to validate the JSON Web Tokens (JWT) sent in the HTTP authorization header for each request. The solution should minimize both custom development effort and operational overhead. Which of the following approaches should the developer choose to secure the API?

  1. Deploy a native Amazon Cognito authorizer on the API Gateway REST API resources to validate the incoming tokens.Cevap
  2. B
    Write a Lambda token authorizer that downloads the JSON Web Key Set (JWKS), decodes the token, and performs signature verification.
  3. C
    Use an Amazon Cognito federated identity pool to exchange the token for temporary security credentials to sign requests with Signature Version 4.
  4. D
    Set up a Lambda proxy integration and handle token decryption and validation within the business logic of the backend Lambda function.

Cevap

Deploy a native Amazon Cognito authorizer on the API Gateway REST API resources to validate the incoming tokens.
Deploying a native Amazon Cognito authorizer is the correct approach. API Gateway provides built-in integration with Cognito User Pools. By configuring a Cognito authorizer, API Gateway automatically validates the signature and expiration of the JWT before forwarding the request to the integration backend. This requires zero custom code, minimizes developer effort, and lowers latency and costs.

Adım Adım Çözüm

1
Identify the authentication source
The identity source is Amazon Cognito User Pools, which issues standard JSON Web Tokens (JWT) upon successful authentication.
This determines which authorization methods are compatible with the token type.
2
Evaluate the architectural constraints
The solution must minimize custom development effort and operational overhead.
This rules out options that require writing custom authorizer code or backend validation logic.
3
Select the native API Gateway capability
API Gateway has a built-in Cognito User Pools authorizer that handles JWT validation natively.
A native authorizer requires no custom code, lowering operational overhead and automatically rejecting unauthorized requests before they reach backend integrations.

Anahtar Kavram

Amazon API Gateway Cognito User Pools Authorizer
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru