Examkin

Soru

Zorluk: OrtaApplication Authentication and Authorization with Amazon Cognito

A developer is implementing a new mobile application that accesses a REST API hosted on Amazon API Gateway with an AWS Lambda proxy integration. Users will authenticate against an Amazon Cognito User Pool. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them, and the backend Lambda function must be able to retrieve the user's email address and custom attributes to perform application-level authorization.

Which configuration should the developer implement to meet these requirements with the least operational overhead?

  1. A
    Implement a custom Lambda authorizer that extracts the token from the request header, calls the Cognito GetUser API to validate the token, and returns an IAM policy. Retrieve the user attributes in the backend Lambda by calling the Cognito SDK.
  2. B
    Configure an Amazon Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials, sign the API requests using Signature Version 4, and configure API Gateway with AWS_IAM authorization. In the Lambda function, decode the caller's credentials to extract the user claims.
  3. Configure an API Gateway Cognito User Pool authorizer on the API methods, passing the ID token in the Authorization header. In the Lambda function, retrieve the user attributes from the request context claims.Cevap
  4. D
    Configure an IAM trust policy on the backend Lambda function to trust the Cognito User Pool directly. Configure API Gateway to forward the raw request, and let the Lambda function use the AWS SDK to verify the signature of the incoming JWT token.

Cevap

Configure an API Gateway Cognito User Pool authorizer on the API methods, passing the ID token in the Authorization header. In the Lambda function, retrieve the user attributes from the request context claims.
The correct configuration uses the native Cognito User Pool authorizer in API Gateway. When integrated with a Lambda proxy, API Gateway validates the ID token and makes all claims (such as email and custom attributes) available to the backend Lambda function under the request context claims. This requires no custom code, minimizing operational overhead.

Adım Adım Çözüm

1
Configure the API Gateway method to use a Cognito User Pool authorizer.
API Gateway is configured to authenticate incoming API requests by validating the signature and expiration of the JWT ID token supplied in the Authorization header.
This offloads token validation from the backend application code to the API Gateway edge.
2
Ensure the client application sends the ID token obtained from Cognito authentication in the Authorization header.
The client successfully passes the authenticated user's identity to API Gateway.
The Cognito User Pool authorizer requires the identity token to verify the user and extract claims.
3
Access the user attributes within the Lambda function using the event's request context.
The Lambda function retrieves the email and custom attributes from event.requestContext.authorizer.claims.
API Gateway automatically injects the claims of the validated token into the Lambda integration context, avoiding additional SDK calls.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer integration with Lambda proxy
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Application Authentication and Authorization with Amazon Cognito

Bu konudan daha fazla soru