Examkin

Soru

Zorluk: Çok zorAPI Gateway Security and Authorization

A developer is building a secure enterprise document management portal. User authentication is managed by a third-party Identity Provider (IdP). The client applications send a JSON Web Token (JWT) issued by the IdP in the `Authorization` header of every request to an Amazon API Gateway REST API. The developer must secure the `/documents/delete` resource so that only users who have a custom claim `user_role` set to `Administrator` in the JWT are permitted to invoke the backend service. This validation must be enforced at the API Gateway boundary to prevent unauthorized requests from invoking the backend integration. Which solution should the developer implement to meet these requirements with the least operational overhead?

  1. Create an API Gateway Lambda Request Authorizer. In the Lambda function, verify the signature of the incoming JWT using the Identity Provider's JSON Web Key Set (JWKS), extract the custom `user_role` claim, and return an IAM policy that allows the `execute-api:Invoke` action on the target resource if the claim value is `Administrator`.Cevap
  2. B
    Set up an Amazon Cognito User Pool federated with the third-party IdP, and configure an API Gateway Cognito User Pools Authorizer. In the method request settings for the `/documents/delete` resource, add custom OAuth Scopes to validate that the custom `user_role` attribute in the user's identity token matches `Administrator`.
  3. C
    Set up an Amazon Cognito Identity Pool to exchange the third-party JWT for temporary AWS credentials. Enable IAM authorization on the `/documents/delete` resource, and write a custom API Gateway Resource Policy that denies requests if the `$context.authorizer.claims.user_role` context variable does not match `Administrator`.
  4. D
    Set up a Lambda Proxy Integration for the `/documents/delete` resource. In the backend Lambda function, extract the custom `user_role` claim from the request payload, and return an API Gateway Resource Policy dynamically to deny the request if the claim value is not `Administrator`.

Cevap

Create an API Gateway Lambda Request Authorizer to decode and validate the token, extract the custom claim, and generate an IAM policy that grants access if the claim matches the required role.
Implementing an API Gateway Lambda Request Authorizer allows the developer to run custom code at the API Gateway boundary. The Lambda function can fetch the IdP's JSON Web Key Set (JWKS), verify the JWT signature, read the custom `user_role` claim, and generate an IAM policy that allows or denies access using the `execute-api:Invoke` action.

Adım Adım Çözüm

1
Analyze client authentication token properties.
The client passes a standard JWT issued by a third-party IdP containing custom claims.
Understanding the token type and claims is essential for choosing the correct authorizer type.
2
Evaluate API Gateway native authorizer capabilities.
Built-in Cognito User Pool Authorizers cannot perform custom authorization logic (such as validating custom claims like `user_role` at the API Gateway level) and do not support OIDC scopes on ID tokens.
Enforcing custom claim checks at the API Gateway boundary prevents unauthorized backend execution.
3
Select the appropriate authorization mechanism.
A custom Lambda Authorizer must be implemented to validate the JWT signature against the IdP's JWKS and programmatically inspect the custom claim.
Only Lambda Authorizers allow running custom code at the API Gateway boundary to generate dynamic IAM policies based on arbitrary JWT claims.
4
Return an IAM policy from the Lambda Authorizer.
The Lambda Authorizer returns an IAM policy allowing or denying the `execute-api:Invoke` action on the resource.
API Gateway uses the returned IAM policy to permit or block access to the backend integration.

Anahtar Kavram

API Gateway custom Lambda Authorizers allow developers to perform custom JWT verification and inspect arbitrary token claims at the API Gateway boundary to return an IAM policy.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

API Gateway Security and Authorization

Bu konudan daha fazla soru