Examkin

Soru

Zorluk: OrtaAmazon Cognito Authentication and Authorization

A developer is building a serverless web application that allows users to access corporate resources through a backend REST API hosted on Amazon API Gateway and powered by AWS Lambda. The developer has configured an Amazon Cognito User Pool to handle user authentication. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them, and the backend Lambda function must retrieve the authenticated user's email address to record audit logs. The solution must minimize custom code and operational overhead.

Which two actions should the developer take to meet these requirements?

  1. Configure an API Gateway Cognito User Pools authorizer on the API methods, specifying the Cognito User Pool as the identity source.Cevap
  2. B
    Configure an API Gateway Lambda custom authorizer that calls the Amazon Cognito GetUser API to validate the token and extract user claims.
  3. C
    Configure an Amazon Cognito Identity Pool to authenticate users, and configure AWS IAM authorization on the API Gateway methods.
  4. Use a Lambda proxy integration and access the user's email address from the requestContext.authorizer.claims.email field in the input event.Cevap
  5. E
    Configure API Gateway to forward the authorization token in a custom header, and decode the payload in the Lambda function to extract the email address.

Cevap

Configure an API Gateway Cognito User Pools authorizer on the API methods, specifying the Cognito User Pool as the identity source, and use a Lambda proxy integration to access the user's email address from the requestContext.authorizer.claims.email field in the input event.
The correct options implement the most efficient serverless pattern: using API Gateway's native Cognito User Pools authorizer to authenticate users and validate tokens at the API gateway layer, and then passing the identity claims to the backend Lambda function via the Lambda proxy integration's requestContext. This requires zero custom authorizer code and minimal backend logic to extract the user's email.

Adım Adım Çözüm

1
Select Cognito User Pools as the authentication mechanism for API Gateway.
API Gateway validates tokens natively using the built-in Cognito authorizer.
This minimizes operational overhead by avoiding the need to write custom authorization logic.
2
Enable Lambda proxy integration for the API Gateway integration.
The entire HTTP request context, including authorizer metadata, is passed to the backend Lambda function.
API Gateway automatically populates the authorizer claims in the request event context, enabling the Lambda function to read the user's email.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer integration with Lambda Proxy
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Amazon Cognito Authentication and Authorization

Bu konudan daha fazla soru