Examkin

Soru

Zorluk: ZorResolving IAM and Authorization Failures

A developer is troubleshooting an authorization issue with a REST API in Amazon API Gateway. The API uses a custom Lambda authorizer with caching enabled, and the cache key is set to the Authorization header. When a client sends a request to GET /orders/101 with a valid token, the request succeeds. However, when the same client immediately sends a request to GET /orders/202 using the same token, the client receives a 403 Forbidden error with the message 'User is not authorized to access this resource'. The developer verifies that the client has valid permissions for both order resources. What is the root cause of this authorization failure, and how should it be resolved?

  1. The Lambda authorizer returned a resource ARN specific to the first request's path, which was cached. Subsequent requests for different paths with the same token reuse the cached policy and are denied. To resolve this, configure the Lambda authorizer to return a wildcard resource ARN covering all paths, or disable caching.Cevap
  2. B
    The Lambda authorizer's IAM execution role lacks permissions to assume the client's IAM role for the second request. To resolve this, modify the trust policy of the client's IAM role to allow the sts:AssumeRole action for the Lambda authorizer's execution role.
  3. C
    The API Gateway service principal lacks permissions to invoke the Lambda authorizer for the second path resource. To resolve this, add a resource-based policy to the Lambda authorizer function to grant lambda:InvokeFunction permission to apigateway.amazonaws.com.
  4. D
    The API Gateway API must use a Cognito User Pools authorizer instead of a custom Lambda authorizer to validate identity tokens. To resolve this, configure Cognito User Pools and associate it with a Cognito Identity Pool to map groups to IAM roles for dynamic path authorization.

Cevap

The Lambda authorizer returned a resource ARN specific to the first request's path, which was cached. Subsequent requests for different paths with the same token reuse the cached policy and are denied. To resolve this, configure the Lambda authorizer to return a wildcard resource ARN covering all paths, or disable caching.
When caching is enabled, API Gateway caches the policy returned by the Lambda authorizer using the cache key (the token). If the policy specifies a resource-specific ARN (like the path of the first request), any subsequent requests to a different path with the same token will use the cached policy and fail with a 403 Forbidden error because that path is not allowed in the policy. Returning a wildcard ARN or disabling caching resolves this issue.

Adım Adım Çözüm

1
Analyze the symptoms of the authorization failure where the first request succeeds but the subsequent request with the same token to a different path fails with a 403 Forbidden error.
Identify that the Lambda authorizer has caching enabled with the Authorization header as the cache key.
This helps narrow down the problem to how API Gateway caches and evaluates the IAM policy returned by the Lambda authorizer.
2
Examine how API Gateway caches policies based on the custom Lambda authorizer configuration.
The authorizer returns a policy containing the resource ARN for the specific path of the first request (/orders/101), which is then cached by API Gateway for that authorization token.
API Gateway uses the cached policy for all subsequent requests containing the same token during the TTL period, without invoking the Lambda function again.
3
Determine how the cached policy affects the second request (GET /orders/202).
Because the cached policy only allows access to the resource ARN for /orders/101, API Gateway denies access to /orders/202 and returns a 403 Forbidden error.
This confirms that the narrow resource scope in the cached policy is the root cause of the authorization failure.
4
Formulate the resolution to fix the authorization issue.
Modify the Lambda authorizer code to return a wildcard resource ARN (e.g., /orders/*) so that the cached policy permits access to all relevant paths, or disable caching if granular per-path verification is required on every request.
This ensures that either the cached policy is broad enough to cover all client requests or that the authorizer runs on every request to generate a precise policy.

Anahtar Kavram

API Gateway custom Lambda authorizer policy caching and resource ARN validation.
Bu soruyu puanla

Konular

Resolving IAM and Authorization Failures

Bu konudan daha fazla soru