A developer is configuring security for a REST API in Amazon API Gateway. The API has two separate endpoints with different access control requirements:
1. The first endpoint must authenticate users using JSON Web Tokens (JWTs) from a Cognito User Pool.
2. The second endpoint must restrict access to specific IAM users and roles within the AWS account.
Which two configuration actions must the developer take to implement these security controls? (Select TWO.)
- Create a Cognito User Pool authorizer in API Gateway and associate it with the first endpoint.Cevap
- Set the authorization type for the second endpoint to AWS_IAM in API Gateway.Cevap
- CCreate a Cognito Identity Pool authorizer in API Gateway and associate it with the first endpoint.
- DSet the authorization type for the second endpoint to CUSTOM and attach an IAM policy to the API Gateway stage.
- EConfigure a Lambda proxy integration on the first endpoint to automatically validate Cognito User Pool tokens.
Cevap
To secure the API, the developer must create a Cognito User Pool authorizer in API Gateway for the first endpoint and set the authorization type for the second endpoint to AWS_IAM.
The correct options are configuring a Cognito User Pool authorizer for the first endpoint and setting the authorization type to AWS_IAM for the second endpoint. A Cognito User Pool authorizer allows API Gateway to authenticate API calls using tokens from Amazon Cognito User Pools without needing custom Lambda authorizer code. Setting the authorization type to AWS_IAM ensures that callers must sign their requests with AWS credentials, allowing the developer to control access via IAM policies.
Adım Adım Çözüm
Anahtar Kavram
API Gateway supports native integration with Cognito User Pools using Cognito Authorizers, and native IAM authorization using AWS_IAM to restrict access to IAM identities.