A startup is deploying a secure REST API on Amazon API Gateway. External clients will authenticate using JSON Web Tokens (JWTs) issued by a third-party identity provider. The startup needs to implement an authorization solution at the API Gateway layer that validates the JWT, denies unauthorized access before invoking backend resources, and performs fine-grained authorization based on the user's subscription tier claim embedded in the JWT. The backend is an AWS Lambda function integrated using a Lambda custom integration (non-proxy). Which approach meets these requirements with the least operational complexity?
- Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.Cevap
- BConfigure an Amazon Cognito Identity Pool to authenticate the third-party tokens. In API Gateway, configure a Cognito User Pool authorizer to validate the incoming token, and rely on API Gateway to automatically forward the user claims in the integration request to the backend Lambda custom integration.
- CImplement a Lambda custom authorizer to validate the JWT. Configure the authorizer to append the subscription tier claim as a custom header in the API Gateway integration request. Configure the backend Lambda function to automatically retrieve this header from the handler's default event.headers payload.
- DImplement a Lambda custom authorizer to validate the JWT. Configure the authorizer to return an IAM policy that allows execute-api:Invoke on the backend Lambda function's ARN, and passes the subscription tier claim using the $stageVariables.subscriptionTier context variable.
Cevap
Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.
The correct approach involves using a Lambda custom authorizer because it allows validating JWTs from external identity providers. The authorizer returns an IAM policy allowing the execute-api:Invoke action on the API Gateway method ARN, along with a context map. Since the backend Lambda function is integrated using a Lambda custom integration (non-proxy), we must use an API Gateway mapping template to extract the subscription tier metadata from the authorizer context using the $context.authorizer.subscriptionTier variable and pass it to the backend Lambda function payload.
Adım Adım Çözüm
Anahtar Kavram
API Gateway custom Lambda authorizers evaluate external tokens, return IAM policies targeting API Gateway execution ARNs, and provide context metadata that must be mapped to custom integrations.