An organization is migrating a legacy system to AWS and exposing its services through an Amazon API Gateway REST API. The client applications authenticate using custom JWTs issued by a proprietary on-premises identity provider that cannot be integrated with Amazon Cognito. The API Gateway must validate these tokens and extract custom claims to authorize requests before forwarding them to the backend microservices. Which authorization strategy should the developer implement to secure this API with the least operational complexity?
- Configure a Lambda authorizer on the API Gateway to decode and validate the incoming JWT, and return an IAM policy that grants or denies access to the API methods.Cevap
- BConfigure a Lambda proxy integration for the API, and write validation logic inside the backend Lambda function to decode the JWT and return a 401 Unauthorized status if invalid.
- CConfigure an Amazon Cognito identity pool to authenticate the clients, exchange their proprietary JWTs for temporary AWS credentials, and enforce IAM authorization on the API.
- DConfigure an Amazon Cognito user pool with a built-in Cognito authorizer on the API Gateway, and configure client applications to authenticate natively with User Pool endpoints.
Cevap
Configure a Lambda authorizer on the API Gateway to decode and validate the incoming JWT, and return an IAM policy that grants or denies access to the API methods.
The correct strategy is to use a Lambda authorizer on the API Gateway. This allows the API Gateway to execute a custom Lambda function to validate the incoming proprietary JWT and return a cached IAM policy that controls access to the API methods, securing the API at the perimeter.
Adım Adım Çözüm
Anahtar Kavram
Lambda Authorizers for Custom Token Validation
Tahmini Süre:1m 30s