Examkin

Soru

Zorluk: OrtaAPI Gateway Security and Authorization

A startup is building a multi-tenant SaaS application on AWS. The application exposes a REST API through Amazon API Gateway. The startup uses an Amazon Cognito User Pool for user authentication, and the frontend client receives a JSON Web Token (JWT) after successful login. The developer needs to secure a set of API endpoints: some endpoints require validation of standard JWT claims, while other endpoints require validating the JWT and then looking up the user's subscription status in a DynamoDB table to grant or deny access. Which two configuration methods should the developer use on the API Gateway endpoints to meet these requirements with the least operational overhead? (Select TWO.)

  1. Configure a built-in API Gateway Amazon Cognito user pool authorizer for endpoints that only require standard JWT claim validation.Cevap
  2. Configure an API Gateway Lambda authorizer of token type for endpoints that require querying the database to check subscription status.Cevap
  3. C
    Configure an API Gateway Lambda authorizer of request parameter type to manually verify the JWT signature and expiration for standard claims.
  4. D
    Configure an Amazon Cognito Identity Pool authorizer directly on API Gateway to validate the JWT and verify the subscription status.
  5. E
    Configure API Gateway Lambda Proxy integration with IAM authorization to automatically pass the client JWT to the backend Lambda function.

Cevap

To secure the API endpoints with minimal operational overhead, the developer should configure a built-in API Gateway Amazon Cognito user pool authorizer for the standard JWT claim validation, and configure an API Gateway Lambda authorizer of token type for endpoints requiring a DynamoDB database lookup.
For endpoints requiring only standard validation of Cognito User Pool JWTs, using the built-in API Gateway Cognito User Pool authorizer requires no custom code, minimizing operational overhead. For endpoints requiring database checks (such as verifying subscription status in DynamoDB), a custom Lambda authorizer must be used to execute the custom database query and return the corresponding IAM policy.

Adım Adım Çözüm

1
Analyze endpoint requirements
Identified two distinct types of authentication requirements: simple validation of Cognito JWT claims, and custom validation requiring a database lookup.
This determines the capabilities required for the authorizers on each API route.
2
Select authorization method for standard validation
Chose the built-in Amazon Cognito user pool authorizer.
API Gateway natively validates Cognito User Pool JWTs without custom code, satisfying the least operational overhead criteria.
3
Select authorization method for custom database validation
Chose an API Gateway Lambda authorizer of token type.
Because checking a database requires custom execution logic not supported by the built-in Cognito authorizer, a Lambda authorizer must be used to perform the query and return an IAM policy.

Anahtar Kavram

API Gateway Authorizers selection based on requirement complexity
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru