An organization is deploying a multi-tenant backend on Amazon API Gateway. The developer must implement security and authorization for two specific API resources:
1. A `/dashboard` resource that needs to validate identity tokens generated by an Amazon Cognito User Pool. The validation must be handled natively by API Gateway to minimize latency and avoid executing custom backend code.
2. A `/partner-integration` resource that must validate custom OAuth 2.0 tokens issued by a third-party partner's identity provider, using custom validation and database lookups.
Which TWO configuration steps should the developer perform to secure these resources?
- Create a Cognito User Pools authorizer for the API and configure the `/dashboard` methods to use this authorizer.Cevap
- Create a Lambda authorizer for the API and configure the `/partner-integration` methods to use it to validate the third-party tokens.Cevap
- CConfigure an Amazon Cognito Identity Pools authorizer for the `/dashboard` methods to validate the User Pool JWTs.
- DCreate a Lambda authorizer for the `/dashboard` resource that downloads the JSON Web Key Set (JWKS) to validate the Cognito identity token signatures.
- EConfigure the `/partner-integration` resource to use Lambda proxy integration, which automatically validates third-party OAuth 2.0 headers.
Cevap
Create a Cognito User Pools authorizer for the dashboard resource, and a Lambda authorizer to handle the custom third-party token validation for the partner integration resource.
To authenticate requests using Amazon Cognito User Pools without writing custom code, API Gateway provides a built-in Cognito User Pools authorizer. For validating third-party OAuth 2.0 tokens that require custom logic and database lookups, a Lambda authorizer must be implemented.
Adım Adım Çözüm
Anahtar Kavram
API Gateway provides native Cognito User Pools authorizers for built-in JWT verification and Lambda authorizers for custom authentication logic.