Examkin

API Gateway Security and Authorization

62 soru

Tüm türler62Çoktan seçmeli33Çoklu seçim29
Soru 1Soru →

A developer is securing a REST API in Amazon API Gateway for a social media application. Users authenticate via a web frontend using Amazon Cognito. The developer needs to restrict access to the API Gateway resources to authenticated users only and pass the user's username and email to the backend AWS Lambda function for auditing. The solution must minimize custom code and use built-in API Gateway features. Which two steps must the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.; In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.

Cevap

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods, and extract the user's identity details from the event.requestContext.authorizer.claims context object in the backend Lambda function.
To secure the API with minimal custom code, the developer should configure an API Gateway Cognito User Pool Authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) issued by Cognito User Pools. Once validated, API Gateway automatically propagates the user's token claims (including email and username) to the backend integration, where they can be extracted directly from the requestContext.authorizer.claims context variable inside the Lambda function.

Adım Adım Çözüm

1
Select the built-in Cognito User Pool Authorizer in API Gateway.
API Gateway is configured to automatically validate the JWT tokens sent by the client frontend.
This avoids writing custom validation code and utilizes AWS managed capabilities.
2
Associate the authorizer with the specific HTTP/REST methods on the API Gateway resource.
Unauthenticated requests are blocked at the gateway level with a 401 Unauthorized response, protecting the backend.
This secures the endpoints before requests reach the backend Lambda function.
3
Access the user claims within the Lambda handler using the integration event object.
The Lambda function receives the username and email in the event object without performing additional decoding or verification.
API Gateway automatically populates the claims under requestContext.authorizer.claims when the Cognito authorizer successfully validates the token.

Anahtar Kavram

API Gateway Cognito User Pools Integration
Soru 2Soru →

A developer is designing a secure REST API using Amazon API Gateway that will be consumed by external client applications. The clients authenticate against a third-party Identity Provider (IdP) that is not compatible with Amazon Cognito, receiving a custom JSON Web Token (JWT) that includes specific scopes in the payload. The REST API must authorize access to resources based on these scopes and forward the verified user identity metadata to a backend Lambda function using a Lambda proxy integration. The developer wants to implement a solution that minimizes both authorization latency and cost. Which configuration should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.

Cevap

Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.
The correct solution uses an API Gateway Lambda authorizer to validate the third-party JWT. Because the token is not issued by Amazon Cognito, a built-in Cognito authorizer cannot be used. By setting an Identity Source (such as the Authorization header), API Gateway caches the generated IAM policy, preventing downstream invocations of the authorizer Lambda function on subsequent calls with the same token. Additionally, return values in the context object from the authorizer are forwarded to the backend Lambda function under requestContext.authorizer, satisfying the requirement to pass user metadata securely while keeping backend processing optimized.

Adım Adım Çözüm

1
Create and deploy a Lambda authorizer function that receives the third-party JWT, validates its cryptographic signature against the IdP's public keys, and inspects the payload claims for valid scopes.
The Lambda function is ready to return an IAM policy document and a custom context object containing user metadata.
API Gateway requires a custom Lambda authorizer to inspect and validate third-party tokens since built-in Cognito authorizers only validate Cognito-issued tokens.
2
Configure the API Gateway REST API to use the Lambda authorizer, set the authorization caching TTL, and specify the Identity Source (such as method.request.header.Authorization).
API Gateway caches the policy document returned by the authorizer for matching tokens, avoiding repeated invocations of the authorizer function.
Caching reduces API latency and reduces the cost of running the authorizer Lambda function on every API request.
3
Map the required user identity claims to the context object returned by the Lambda authorizer, and use Lambda Proxy Integration for the backend integration.
The backend Lambda function receives the mapped metadata in the requestContext.authorizer object of the incoming event.
Using the context object allows passing validated client metadata to the backend Lambda function securely without requiring the backend function to parse or re-validate the token.

Anahtar Kavram

Using API Gateway Lambda authorizers to validate third-party JSON Web Tokens (JWTs) and caching the authorization policy response to minimize backend invocations.
Tahmini Süre:2m 0s
Soru 3Soru →

A company is developing a fitness tracking mobile application. The application needs to access a REST API hosted on Amazon API Gateway to retrieve user workout histories. The development team wants to implement an authorization mechanism that allows users to authenticate using their existing email and password credentials, validates their JSON Web Tokens (JWTs) directly at the API Gateway level without invoking a custom Lambda function, and extracts user identity claims for backend processing. Which configuration should the developer implement to meet these requirements with the lowest latency and operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

Cevap

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.
The correct configuration is to use the built-in Amazon Cognito User Pools authorizer. This option integrates directly with the user pool to authenticate and validate the signature of incoming JWT tokens without invoking custom Lambda code. Once validated, user claims are automatically populated into the request context and sent to the backend integration, providing a highly optimized, low-overhead solution.

Adım Adım Çözüm

1
Analyze the requirements for user authentication, token validation, and latency control.
The solution requires user directory authentication (username/password), token validation at the API Gateway edge without executing custom code, and access to identity claims in backend integrations.
This establishes that the solution must use a native API Gateway mechanism rather than custom authorizer code.
2
Select the appropriate Amazon Cognito feature for user directories.
Cognito User Pools provides the directory and authentication flow, returning JWT tokens containing claims.
Cognito Identity Pools provides temporary AWS credentials instead of user authentication directory features.
3
Configure the native API Gateway authorizer that integrates directly with the Cognito User Pool.
Configuring a Cognito User Pools authorizer on the API Gateway REST API allows native verification of the JWT signature and expiration, and automatically passes the claims via the integration request context.
This provides the lowest latency and requires no custom code maintenance, satisfying all requirements.

Anahtar Kavram

API Gateway Cognito User Pools Authorizer
Soru 4Soru →

A developer is designing a secure serverless backend where a single-page application (SPA) needs to access a REST API hosted on Amazon API Gateway. Users authenticate using Amazon Cognito User Pools. The developer needs to implement authorization such that standard users can only invoke the GET methods on /items resources, while administrative users (members of the 'Admins' Cognito group) can invoke any method on /items and /admin resources. Which two configuration steps should the developer perform to implement this authorization model?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS_IAM authorization on the API Gateway resources. Integrate the Amazon Cognito User Pool with an Amazon Cognito Identity Pool, configure group-based role mapping to associate the 'Admins' group with a high-privilege IAM role, and have the client application sign API requests using temporary AWS credentials via Signature Version 4.; Configure an API Gateway Lambda Authorizer. In the authorizer function, verify the signature of the JSON Web Token (JWT) provided by the Cognito User Pool, inspect the 'cognito:groups' claim in the payload, and dynamically generate an IAM policy that allows or denies access to the specific resource paths.

Cevap

To implement group-based authorization on API Gateway with Cognito User Pools, the developer can either use AWS_IAM authorization with Cognito Identity Pools and group-to-role mapping, or implement a Lambda Authorizer that inspects the 'cognito:groups' claim in the JWT and dynamically generates an IAM policy.
The correct options represent the two main architectures for implementing group-based access control in API Gateway. Using AWS_IAM authorization with Cognito Identity Pools maps User Pool groups to distinct IAM roles, letting API Gateway natively enforce authorization via SigV4 signed requests. Using a Lambda Authorizer allows developers to decode the JWT, inspect the 'cognito:groups' claim, and dynamically return an IAM policy allowing or denying access to specific routes.

Adım Adım Çözüm

1
Identify the authorization requirements.
The system needs to restrict API access based on Cognito groups, which requires mapping groups to specific API paths and methods.
This establishes the scope and logic needed for the authorization policy.
2
Evaluate the AWS_IAM and Cognito Identity Pool approach.
By mapping user groups to different IAM roles via Cognito Identity Pools, the client can sign requests with SigV4, allowing API Gateway to evaluate permissions natively via IAM policies.
This offloads authorization logic to native AWS features, minimizing custom development.
3
Evaluate the custom Lambda Authorizer approach.
A Lambda Authorizer can verify the Cognito JWT signature, parse the 'cognito:groups' claim, and dynamically generate an IAM policy based on group membership.
This is standard when the client uses bearer tokens and avoids SigV4 request signing.

Anahtar Kavram

Fine-grained API Gateway authorization using Cognito groups, IAM policies, and Lambda Authorizers
Soru 5Soru →

A logistics company is designing a REST API in Amazon API Gateway to allow partner clients to retrieve shipment data. Partners authenticate against an external OAuth 2.0 Identity Provider (IdP) and receive a JWT access token containing custom scopes like `shipments:read`. The developer wants to authenticate the tokens and enforce access control using these custom scopes at the API Gateway level with minimal custom code. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create and configure an Amazon Cognito User Pool with the external IdP as a federated provider, then create a Cognito User Pool authorizer in API Gateway.; Associate the Cognito authorizer with the API method, and specify the required custom scopes in the OAuth Scopes field of the Method Request configuration.

Cevap

To secure the REST API with minimal custom code, the developer should create and configure an Amazon Cognito User Pool federated with the external IdP, set up a Cognito User Pool authorizer, and then specify the required custom scopes in the Method Request configuration.
The correct options involve configuring an Amazon Cognito User Pool federated with the external Identity Provider and creating a Cognito User Pool authorizer. This allows API Gateway to handle JWT signature validation natively. By configuring the method request with the required OAuth scopes, API Gateway natively verifies that the token contains the matching scope claims, preventing unauthorized traffic from reaching the backend with zero custom code.

Adım Adım Çözüm

1
Integrate the external Identity Provider with Amazon Cognito.
Amazon Cognito User Pool is created and configured with the external IdP as a federated provider, allowing API Gateway to recognize the external tokens via a Cognito User Pool authorizer.
This establishes trust and allows API Gateway to natively validate the JWT token structure and signature without custom validation code.
2
Configure the Cognito User Pool authorizer in API Gateway.
A Cognito User Pool authorizer is added to the API Gateway REST API and linked to the created Cognito User Pool.
This registers the authorizer with the API Gateway deployment so it can be associated with individual methods.
3
Enable scope validation on the API methods.
The Cognito authorizer is associated with the target method, and custom scopes (such as 'shipments:read') are added to the OAuth Scopes field in the Method Request configuration.
This configures API Gateway to automatically inspect the incoming token for the required scopes and reject unauthorized requests before they reach the backend.

Anahtar Kavram

API Gateway integration with Amazon Cognito User Pools for federated authentication and native OAuth scope validation.
Tahmini Süre:1m 30s
Soru 6Soru →

A developer is designing a serverless backend where a single-page application (SPA) needs to access a private REST API hosted on Amazon API Gateway. The developer wants to authenticate users using an Amazon Cognito User Pool and grant them access to the API Gateway endpoints. The client application needs to acquire a JSON Web Token (JWT) after user login and pass it to API Gateway for validation. Which configuration should the developer implement in API Gateway to authorize these requests with the least administrative effort and cost?

Cevabı ve açıklamayı göster

Cevap: Create a Cognito User Pool Authorizer in API Gateway, and configure the API method to use this authorizer while specifying the Identity Source header.

Cevap

Create a Cognito User Pool Authorizer in API Gateway, and configure the API method to use this authorizer while specifying the Identity Source header.
The correct option is to create a Cognito User Pool Authorizer in API Gateway and configure the API method to use this authorizer. This option represents the native integration designed specifically for Amazon Cognito User Pools. It automatically validates incoming JWT signatures, expiration, and audiences at the API Gateway edge, requiring zero custom code and adding no extra execution costs for custom Lambda authorizers.

Adım Adım Çözüm

1
Identify the authentication source and token type.
The authentication source is an Amazon Cognito User Pool, and the token is a standard JWT.
This determines which authorization mechanisms are natively supported by API Gateway.
2
Evaluate native API Gateway features against custom solutions.
API Gateway offers a built-in Cognito User Pool Authorizer that handles JWT validation natively.
A native feature reduces administrative overhead, eliminates the need for custom Lambda authorizers, and minimizes costs.
3
Configure the method execution settings.
Bind the API method to the Cognito User Pool Authorizer and define the header where the JWT will be supplied.
This ensures the API Gateway enforces authorization at the entry point prior to routing requests downstream.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer
Tahmini Süre:1m 30s
Soru 7Soru →

A retail company has developed a mobile application where users authenticate using Amazon Cognito User Pools. The backend services are exposed through an Amazon API Gateway REST API. The company needs to restrict API access so that only authenticated users with a valid JSON Web Token (JWT) can invoke the API methods. The developer wants to implement this validation with the lowest development effort and without writing any custom authorization code. Which configuration should the developer choose to secure the API?

Cevabı ve açıklamayı göster

Cevap: Configure a built-in API Gateway Cognito authorizer that directly validates the incoming user pool tokens.

Cevap

Configure a built-in API Gateway Cognito authorizer that directly validates the incoming user pool tokens.
Configuring a built-in API Gateway Cognito authorizer is the most operationally efficient solution. It natively integrates API Gateway with Amazon Cognito User Pools, allowing API Gateway to automatically validate the incoming JWT signature, expiration, and client ID. This requires zero custom code and incurs no additional Lambda execution costs for authorization.

Adım Adım Çözüm

1
Analyze the requirement to secure an Amazon API Gateway REST API using tokens from Amazon Cognito User Pools.
Identify that the solution must validate Cognito JSON Web Tokens (JWTs).
Cognito User Pools issue JWTs upon successful user authentication.
2
Determine the approach that requires the lowest development effort and zero custom authorization code.
Select the built-in API Gateway Cognito authorizer.
The Cognito authorizer is a native, code-free integration within API Gateway that automatically validates JWT signature, expiration, and audience.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer
Soru 8Soru →

A developer is designing a REST API using Amazon API Gateway. The API must support two distinct clients: a mobile application where users authenticate and receive JSON Web Tokens (JWTs) from Amazon Cognito, and a legacy third-party application that sends custom tokens that must be validated against an external database.

Which two authorization mechanisms should the developer configure on API Gateway to secure these client requests? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Cognito User Pools authorizer to validate the JWTs sent by the mobile application.; Configure a custom Lambda authorizer to parse and validate the legacy client application tokens.

Cevap

Configure a Cognito User Pools authorizer to validate the JWTs sent by the mobile application, and configure a custom Lambda authorizer to parse and validate the legacy client application tokens.
To secure the API requests, a native Cognito User Pools authorizer should be used for the mobile application since API Gateway natively decodes and validates Cognito JWTs. For the legacy client application, a custom Lambda authorizer is required to extract the token and perform custom validation logic against the external database.

Adım Adım Çözüm

1
Determine the auth mechanism for the Cognito-authenticated mobile app.
Identify that the Cognito User Pools authorizer is a native, built-in feature of API Gateway designed to validate Cognito user pool tokens without extra code.
Reduces implementation overhead, avoids Lambda execution costs for auth, and complies with best practices.
2
Determine the auth mechanism for the legacy partner client using custom tokens.
Identify that a custom Lambda authorizer (token-based or request-based) is necessary to run the custom validation logic against the external database.
API Gateway does not natively support external database lookups for auth, making a Lambda authorizer the proper extension point.

Anahtar Kavram

Selecting native Cognito User Pools authorizers for Cognito JWTs and custom Lambda authorizers for custom token structures and external database lookups.
Soru 9Soru →

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API must authenticate users who are managed in an external identity provider that supports OpenID Connect (OIDC). The requirements specify that the solution must minimize custom code, validate the JSON Web Token (JWT) at the API Gateway layer, and securely pass user attributes—such as custom groups—to the backend Lambda function for fine-grained authorization. Additionally, the client application must not need to manage or sign requests with temporary AWS credentials.

Which architecture should the developer implement to meet these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool federated with the external OIDC provider. Set up an API Gateway Cognito Authorizer that points to the Cognito User Pool. In the API Gateway Method Request, set the Authorization header. In the backend Lambda function, extract the user attributes from the request's context event under the authorizer claims.

Cevap

Configure an Amazon Cognito User Pool federated with the external OIDC provider, set up an API Gateway Cognito Authorizer pointing to the user pool, and extract the user attributes from the request's context event under the authorizer claims in the backend Lambda function.
The correct solution uses an Amazon Cognito User Pool federated with the external OIDC provider. This configuration allows API Gateway to leverage the built-in Cognito Authorizer, which handles token validation at the gateway edge. Verified claims are automatically passed to the Lambda function in the request context event, eliminating custom validation code and client-side request signing.

Adım Adım Çözüm

1
Analyze the token validation requirements and identity source.
The identity source is an external OIDC provider, and token validation must happen at the API Gateway layer.
This establishes that the API Gateway layer should handle validation, narrowing options to authorizers that natively validate OIDC/JWT tokens.
2
Evaluate native authorization options versus client-side overhead.
Using a Cognito Identity Pool requires IAM authorization and Signature Version 4 signing by the client, which violates the requirement to avoid client-side credentials management.
A Cognito User Pool with a Cognito Authorizer validates OIDC-derived tokens natively at the API Gateway edge, avoiding client-side request signing.
3
Verify custom code and claim transmission constraints.
A custom Lambda authorizer requires manual signature validation and parsing, violating the goal to minimize custom code. In contrast, the Cognito Authorizer automatically passes validated claims to the backend Lambda integration's request context.
This confirms that a federated Cognito User Pool combined with a native Cognito Authorizer is the most efficient, low-code solution.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer integration for federated OIDC authentication.
Soru 10Soru →

A development team is building a mobile application for a bicycle-sharing service. The app allows users to log in using their social media accounts. The backend services expose a REST API hosted on Amazon API Gateway, backed by AWS Lambda. Additionally, the mobile app needs to upload user-generated profile photos directly to a private Amazon S3 bucket without routing the files through the application's backend.

Which two architectural steps should the developer take to implement authentication, API authorization, and secure S3 uploads with the least amount of custom code?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints.; Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.

Cevap

Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints. Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.
The correct solution uses Cognito User Pools for user authentication and secures the API Gateway REST API with the built-in Cognito Authorizer to minimize custom code. It then utilizes a Cognito Identity Pool linked to the User Pool to vend temporary AWS credentials, allowing the mobile application to upload profile photos directly to the private S3 bucket without passing through backend servers.

Adım Adım Çözüm

1
Set up a user directory with Cognito User Pools to manage social identity federation and authentication.
Users are authenticated, and the mobile client receives identity and access tokens (JWTs).
This establishes user identities and allows built-in integration with external social providers.
2
Configure a built-in Cognito Authorizer on the API Gateway REST API.
API Gateway automatically validates the JWT signature and expiration before allowing requests to proceed to the Lambda backend.
This secures the API endpoints with minimal custom code by leveraging native API Gateway integrations.
3
Deploy a Cognito Identity Pool and link it to the User Pool as an identity provider, granting authenticated users an IAM role with write permissions to the S3 bucket.
The mobile app can exchange User Pool tokens for temporary AWS IAM credentials, allowing direct and secure uploads to S3.
This satisfies the requirement to write directly to S3 without routing files through backend servers.

Anahtar Kavram

Combining Cognito User Pools for user authentication/API authorization with Cognito Identity Pools for AWS resource access (S3 direct upload).
Soru 11Soru →

An online learning platform uses Amazon API Gateway to expose a REST API that delivers course catalog data. The platform needs to restrict access to this API so that only users who have registered and authenticated through the platform's Amazon Cognito User Pool can retrieve the catalog. The development team wants to implement this security control with the minimum amount of custom code and operational overhead.

Which configuration should the developer implement to secure the REST API?

Cevabı ve açıklamayı göster

Cevap: Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.

Cevap

Configure an API Gateway Cognito User Pools authorizer on the REST API methods, using the user pool's token for authorization.
The correct option is the one that configures a native Cognito User Pools authorizer. Amazon API Gateway has built-in integration to validate JSON Web Tokens (JWTs) generated by Amazon Cognito User Pools. This native feature requires zero custom code, provides automatic validation, and handles unauthorized requests at the API Gateway layer before invoking any backend integration, meeting all requirements with the lowest operational overhead.

Adım Adım Çözüm

1
Identify the authentication provider and the requirement for authorization.
The users authenticate using an Amazon Cognito User Pool.
Knowing that users are in a Cognito User Pool helps choose between Cognito-native authorizers and custom authorizers.
2
Determine the implementation option with the lowest operational overhead and custom code.
API Gateway has a built-in 'Cognito User Pools authorizer' which natively validates Cognito tokens.
Using native integration eliminates the need to write, deploy, or maintain custom code in a Lambda function.
3
Configure the method execution in API Gateway to use the authorizer.
The REST API methods are secured using the Cognito User Pools authorizer.
This configuration validates the token at the edge before requests reach any backend integration.

Anahtar Kavram

API Gateway Cognito User Pools Authorizer
Tahmini Süre:1m 0s
Soru 12Soru →

A retail company is deploying a secure microservices-based application. A developer needs to expose a backend administrative endpoint via an Amazon API Gateway REST API. The API will be accessed exclusively by internal backend applications running on Amazon EC2 instances. The company requires that all requests be authenticated using AWS Signature Version 4 (SigV4) to enforce IAM-based access control. Which two options should the developer configure to secure this API under these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the API Gateway method authorization type to AWS_IAM.; Attach an IAM policy to the EC2 instances' instance profile that grants execute-api:Invoke permissions on the API Gateway method resource.

Cevap

To secure the API using AWS Signature Version 4 and IAM roles, the developer must set the method authorization type to AWS_IAM and grant the calling applications' EC2 instance profiles an IAM policy with execute-api:Invoke permissions.
The correct options are setting the authorization type to AWS_IAM and attaching an IAM policy with execute-api:Invoke permissions to the EC2 instances' instance profile. Setting the authorization to AWS_IAM utilizes API Gateway's native support for verifying Signature Version 4 headers. For the client application on EC2 to invoke this method, its IAM role must be granted the execute-api:Invoke permission.

Adım Adım Çözüm

1
Configure the API Gateway method to use IAM authentication.
The method's authorization type is set to AWS_IAM.
This native API Gateway feature ensures that all incoming requests must be signed with AWS Signature Version 4 credentials.
2
Assign permissions to the calling EC2 instances.
An IAM policy with execute-api:Invoke permissions is attached to the instances' IAM execution role.
This allows the calling services to successfully invoke the IAM-authorized API Gateway endpoint.

Anahtar Kavram

API Gateway authorization using AWS_IAM and Signature Version 4
Tahmini Süre:2m 0s
Soru 13Soru →

A startup is building a multi-tenant SaaS application on AWS. The application exposes a REST API through Amazon API Gateway. The startup uses an Amazon Cognito User Pool for user authentication, and the frontend client receives a JSON Web Token (JWT) after successful login. The developer needs to secure a set of API endpoints: some endpoints require validation of standard JWT claims, while other endpoints require validating the JWT and then looking up the user's subscription status in a DynamoDB table to grant or deny access. Which two configuration methods should the developer use on the API Gateway endpoints to meet these requirements with the least operational overhead? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a built-in API Gateway Amazon Cognito user pool authorizer for endpoints that only require standard JWT claim validation.; Configure an API Gateway Lambda authorizer of token type for endpoints that require querying the database to check subscription status.

Cevap

To secure the API endpoints with minimal operational overhead, the developer should configure a built-in API Gateway Amazon Cognito user pool authorizer for the standard JWT claim validation, and configure an API Gateway Lambda authorizer of token type for endpoints requiring a DynamoDB database lookup.
For endpoints requiring only standard validation of Cognito User Pool JWTs, using the built-in API Gateway Cognito User Pool authorizer requires no custom code, minimizing operational overhead. For endpoints requiring database checks (such as verifying subscription status in DynamoDB), a custom Lambda authorizer must be used to execute the custom database query and return the corresponding IAM policy.

Adım Adım Çözüm

1
Analyze endpoint requirements
Identified two distinct types of authentication requirements: simple validation of Cognito JWT claims, and custom validation requiring a database lookup.
This determines the capabilities required for the authorizers on each API route.
2
Select authorization method for standard validation
Chose the built-in Amazon Cognito user pool authorizer.
API Gateway natively validates Cognito User Pool JWTs without custom code, satisfying the least operational overhead criteria.
3
Select authorization method for custom database validation
Chose an API Gateway Lambda authorizer of token type.
Because checking a database requires custom execution logic not supported by the built-in Cognito authorizer, a Lambda authorizer must be used to perform the query and return an IAM policy.

Anahtar Kavram

API Gateway Authorizers selection based on requirement complexity
Soru 14Soru →

A developer is implementing security for a new Amazon API Gateway REST API. The API has two specific endpoints:

1. `POST /orders`: Used by a mobile application where users authenticate via Amazon Cognito User Pools.
2. `GET /dashboard/metrics`: Used by an administrative reporting service running on Amazon ECS tasks.

Which TWO actions should the developer take to configure authorization for these endpoints with the least operational overhead?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the `POST /orders` method to use an Amazon Cognito User Pools authorizer to validate incoming tokens.; Configure the `GET /dashboard/metrics` method to use `AWS_IAM` authorization, and grant the ECS task role permission to invoke the API.

Cevap

Configure the POST /orders method to use an Amazon Cognito User Pools authorizer, and configure the GET /dashboard/metrics method to use AWS_IAM authorization while granting the ECS task role permission to invoke the API.
For the POST /orders endpoint, using a built-in Amazon Cognito User Pools authorizer is the recommended path because it requires zero custom code to validate Cognito-issued tokens. For the GET /dashboard/metrics endpoint, AWS_IAM authorization allows the administrative service running on ECS to leverage its IAM task role to sign requests with Signature Version 4, offering a secure, native method to control access without API keys or token exchange.

Adım Adım Çözüm

1
Analyze the requirement for the POST /orders endpoint to authenticate mobile users authenticated with Amazon Cognito User Pools.
Identify that API Gateway offers a native Cognito User Pools authorizer.
This authorizer directly validates JWT tokens from Cognito without custom code, minimizing operational overhead.
2
Analyze the requirement for the GET /dashboard/metrics endpoint to secure access for an administrative service on Amazon ECS.
Identify that the service uses an IAM role and API Gateway supports native AWS_IAM authorization.
AWS_IAM authorization allows callers to sign requests with SigV4 and enables native access control via IAM policies.
3
Configure permissions for the ECS task role to invoke the GET /dashboard/metrics endpoint.
Grant execute-api:Invoke permission on the API resource to the ECS task role.
This secures access based on the principle of least privilege.

Anahtar Kavram

API Gateway Security and Authorization using built-in Cognito and IAM authorizers
Soru 15Soru →

A developer is designing a security architecture for a corporate mobile application that accesses backend microservices through an Amazon API Gateway REST API. The application requirements specify that all API requests must be secured using AWS Signature Version 4 (SigV4) signing, and users must obtain temporary AWS IAM credentials after authenticating with a third-party Identity Provider (IdP). Which configuration should the developer implement to authorize these requests at the API Gateway level with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).

Cevap

Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).
Configuring API Gateway to use AWS_IAM authorization requires clients to sign their requests with AWS Signature Version 4 (SigV4). By integrating the third-party Identity Provider (IdP) with an Amazon Cognito identity pool (federated identities), the application can exchange the IdP authentication token for temporary, limited-privilege AWS credentials. The client can then use these credentials to sign the API requests, providing secure, native API Gateway authorization with minimal operational overhead.

Adım Adım Çözüm

1
Enable AWS_IAM authorization on the API Gateway REST API resource methods.
API Gateway will reject any unsigned requests or requests not signed with valid AWS Signature Version 4 (SigV4) credentials.
To enforce SigV4 authentication at the API Gateway level, ensuring only authorized AWS identities can access the backend.
2
Set up an Amazon Cognito identity pool and configure the third-party Identity Provider (IdP) as an authentication provider.
Users authenticate with the IdP and obtain an ID token, which the application exchanges with the Cognito identity pool for temporary AWS IAM credentials.
To map external federated identities to temporary AWS IAM credentials for the client application.
3
Sign the API Gateway HTTP requests using the retrieved temporary AWS IAM credentials in the client application.
The client successfully sends SigV4-signed requests that API Gateway validates against the IAM permissions associated with the Cognito identity pool's authenticated role.
To complete the SigV4 handshake and securely access the authorized API Gateway endpoints.

Anahtar Kavram

API Gateway AWS_IAM authorization secures endpoints by requiring clients to sign requests with AWS Signature Version 4 (SigV4) credentials. Combining this with Cognito Identity Pools allows external authenticated identities to obtain the temporary credentials needed for SigV4 signing.
Tahmini Süre:1m 30s
Soru 16Soru →

A developer is building a mobile application that uses Amazon Cognito for user authentication. The backend is exposed through an Amazon API Gateway REST API. The developer needs to secure the API so that only authenticated users can access the endpoints. The authentication mechanism must validate JSON Web Tokens (JWTs) issued by Cognito, require no custom authorizer code, and introduce minimal latency. Which API Gateway authorization method should the developer implement?

Cevabı ve açıklamayı göster

Cevap: An Amazon Cognito User Pools authorizer

Cevap

An Amazon Cognito User Pools authorizer
The correct answer is the Amazon Cognito User Pools authorizer. API Gateway provides built-in integration with Cognito User Pools to validate identity tokens (IDs) or access tokens returned from Cognito. This requires no custom coding, operates at the API Gateway level to block unauthorized requests, and minimizes overhead.

Adım Adım Çözüm

1
Identify the authentication source and token type.
The application uses Amazon Cognito for user authentication and receives JWTs.
This narrows the choices down to Cognito-integrated methods.
2
Evaluate the operational overhead and custom code requirement.
Amazon API Gateway offers a built-in Cognito User Pools authorizer that directly validates JWTs without requiring custom code.
This rules out a Lambda authorizer, which requires custom verification code, and Cognito Identity Pools, which are for AWS credential vending.

Anahtar Kavram

Amazon API Gateway Cognito User Pools Authorizer
Tahmini Süre:45s
Soru 17Soru →

A developer is building a mobile application where users authenticate via Amazon Cognito. The backend services are exposed through an Amazon API Gateway REST API. The developer needs to restrict access to the API endpoints so that only successfully authenticated users from a specific Amazon Cognito User Pool can call the API. The mobile client sends the id_token in the Authorization header. Which configuration represents the most operationally efficient and secure solution?

Cevabı ve açıklamayı göster

Cevap: Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.

Cevap

Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.
The correct answer configures a native API Gateway Cognito Authorizer referencing the User Pool. This approach allows API Gateway to automatically and natively validate token signatures, audiences, and expiration, offloading the security checks from the backend application code and saving operational costs.

Adım Adım Çözüm

1
Identify the authentication source and token format.
Amazon Cognito User Pool id_token (JWT).
Knowing that users authenticate via User Pools and produce standard JWTs helps choose the appropriate native integration.
2
Select the API Gateway authorization type that natively handles Cognito JWT verification.
API Gateway Cognito Authorizer.
A Cognito Authorizer allows API Gateway to directly validate token signatures, expiration, and audiences without invoking custom code or Lambda functions.
3
Configure the token source in API Gateway.
Set token source to the 'Authorization' header.
This instructs API Gateway to extract the id_token from the Authorization header of the incoming HTTP request.

Anahtar Kavram

API Gateway Cognito Authorizer
Tahmini Süre:1m 30s
Soru 18Soru →

A developer is designing a serverless multi-tenant SaaS application. The frontend client sends requests to an Amazon API Gateway REST API backed by AWS Lambda. The application uses an external OpenID Connect (OIDC) identity provider for user authentication. The API must validate the signature and expiration of the incoming JSON Web Token (JWT). In addition, access to specific resource paths and HTTP methods must be dynamically controlled based on the user's tenant ID and user role claims embedded in the JWT. The backend Lambda function needs to receive these validated claims to perform tenant-specific business logic without re-decoding or re-validating the token. Which solution meets these requirements with the lowest latency and follows security best practices?

Cevabı ve açıklamayı göster

Cevap: Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.

Cevap

Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.
The correct solution uses a Lambda Request Authorizer to perform custom validation of an external OIDC token and dynamically generate an IAM policy based on the claims (tenant ID and user role) extracted from the token. By returning these claims in the context object of the authorizer's response, API Gateway automatically passes them to the backend Lambda function via the requestContext.authorizer property of the proxy integration event. This keeps latency low, prevents the backend from having to parse or validate the token again, and enforces authorization at the API Gateway layer.

Adım Adım Çözüm

1
Select the appropriate API Gateway authorizer type for external OIDC JWT validation and dynamic routing/authorization policy generation.
A Lambda Request Authorizer is selected because it receives request details (path, method, headers) along with the token, allowing it to perform custom OIDC JWT signature validation and dynamically generate a fine-grained IAM policy.
Cognito User Pools authorizers cannot dynamically generate customized IAM policies based on custom claims for arbitrary external OIDC tokens directly, and Cognito Identity Pools add unnecessary latency by requiring a token-to-credential exchange.
2
Design the Lambda Authorizer logic to validate the JWT and extract claims.
The Lambda Authorizer validates the JWT signature against the external IdP's JWKS endpoint and verifies the claims.
Validation must occur at the API Gateway level to reject unauthorized traffic before it reaches the backend, saving cost and minimizing latency.
3
Generate the IAM policy and the context map in the authorizer response.
The authorizer returns an IAM Policy allowing/denying access to specific method ARNs based on user role and tenant, along with a custom context map containing the user's tenant ID and role.
API Gateway uses the returned IAM policy to authorize the request and passes the context map to the backend integration.
4
Forward the claims to the backend Lambda function via Lambda Proxy Integration.
The backend Lambda function accesses the context properties directly via the requestContext.authorizer event path (e.g., event.requestContext.authorizer.tenantId).
This eliminates the need for custom mapping templates or decoding the token again in the backend Lambda function.

Anahtar Kavram

API Gateway Lambda Authorizers with custom context propagation
Soru 19Soru →

A developer is securing a new Amazon API Gateway REST API. The developer wants to restrict access so that only authenticated users from an Amazon Cognito User Pool can call the API. Which TWO configuration steps are required to set up this built-in authorization mechanism?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an API Gateway authorizer of type Cognito and configure it with the Amazon Cognito User Pool details.; Set the authorization type of the API method to the Cognito authorizer that was created.

Cevap

To implement native Amazon Cognito User Pools authorization for an API Gateway REST API, the developer must first create an authorizer of type Cognito linked to the Cognito User Pool, and then configure the target API methods to use this authorizer.
To secure an API using built-in Cognito validation, API Gateway requires setting up a Cognito authorizer that targets the Cognito User Pool containing the user identities, and then configuring the API methods to enforce this authorization setting.

Adım Adım Çözüm

1
Define a Cognito user pool authorizer in API Gateway
API Gateway is configured with the metadata of the User Pool to validate incoming tokens.
This establishes the link between API Gateway and the Cognito User Pool identity provider.
2
Configure the API method to use the authorizer
The authorization setting on the method execution is updated to the newly created authorizer.
This secures the specific endpoint, ensuring incoming requests are automatically validated using the Cognito token before routing to the integration backend.

Anahtar Kavram

API Gateway Cognito User Pools Authorizer configuration
Soru 20Soru →

An organization is deploying a multi-tenant backend on Amazon API Gateway. The developer must implement security and authorization for two specific API resources:

1. A `/dashboard` resource that needs to validate identity tokens generated by an Amazon Cognito User Pool. The validation must be handled natively by API Gateway to minimize latency and avoid executing custom backend code.
2. A `/partner-integration` resource that must validate custom OAuth 2.0 tokens issued by a third-party partner's identity provider, using custom validation and database lookups.

Which TWO configuration steps should the developer perform to secure these resources?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Cognito User Pools authorizer for the API and configure the `/dashboard` methods to use this authorizer.; Create a Lambda authorizer for the API and configure the `/partner-integration` methods to use it to validate the third-party tokens.

Cevap

Create a Cognito User Pools authorizer for the dashboard resource, and a Lambda authorizer to handle the custom third-party token validation for the partner integration resource.
To authenticate requests using Amazon Cognito User Pools without writing custom code, API Gateway provides a built-in Cognito User Pools authorizer. For validating third-party OAuth 2.0 tokens that require custom logic and database lookups, a Lambda authorizer must be implemented.

Adım Adım Çözüm

1
Analyze the requirements for the dashboard resource
The dashboard needs native validation of Amazon Cognito User Pool tokens without custom code, pointing to the built-in Cognito User Pools authorizer.
This offloads JWT validation to API Gateway directly.
2
Analyze the requirements for the partner integration resource
The partner integration requires custom database lookups and custom token validation for a third-party provider, pointing to a Lambda authorizer.
Built-in authorizers do not support custom third-party OAuth validation logic.

Anahtar Kavram

API Gateway provides native Cognito User Pools authorizers for built-in JWT verification and Lambda authorizers for custom authentication logic.
Sayfa 1 / 4Sonraki