DVA-C02 Question 114
Select 2You are developing a serverless application using AWS Lambda and API Gateway. The API handles sensitive customer data, and it is crucial to ensure that access to the API is properly secured. The security requirements are as follows:
- Only authenticated users should be allowed to invoke the API.
- Fine-grained access control should be implemented to allow or deny access to specific resources based on the user's role.
Which combination of steps should you take to meet these requirements?
- A
Use Amazon Cognito to authenticate users and generate JSON Web Tokens (JWT) for access.
- B
Use an API Gateway Lambda Authorizer to validate authentication and enforce role-based access control.
- C
Enable API Gateway caching to store responses for authenticated users.
- D
Implement IAM policies directly on API Gateway to control user access.
- E
Configure AWS WAF (Web Application Firewall) to manage API access based on roles.
Show answer and explanation
Correct answers: A, B
Explanation
To secure API Gateway and meet the given requirements, you need to integrate Amazon Cognito for user authentication and use a Lambda Authorizer for fine-grained role-based access control. Cognito handles the authentication of users and generates JWTs containing role information, while the Lambda Authorizer validates these tokens and enforces access controls. The other options, such as caching, IAM policies, or WAF, do not fulfill the requirements of authentication and fine-grained access control.
- A. Correct.
This is correct. Amazon Cognito provides user authentication and generates JWTs, which can be used to verify user identity and roles.
- B. Correct.
This is correct. A Lambda Authorizer allows you to validate the JWT and enforce fine-grained role-based access control for API Gateway.
- C. Incorrect.
This is incorrect. API Gateway caching improves performance but does not address authentication or authorization.
- D. Incorrect.
This is incorrect. IAM policies are not designed to provide fine-grained, role-based access control for individual API Gateway resources.
- E. Incorrect.
This is incorrect. AWS WAF is used for managing web traffic and protecting against attacks like SQL injection or DDoS, not for role-based access control.