DVA-C02 Question 120
Single answerYou are developing a serverless application using AWS Lambda and API Gateway. The application needs to allow only authenticated users to access certain API endpoints. You decide to use Amazon Cognito for user authentication. How can you configure the API Gateway to ensure only authenticated users can access the APIs?
- A
Use an API Gateway Lambda authorizer to validate the JWT tokens issued by Amazon Cognito.
- B
Enable resource-based policies on API Gateway and specify the Amazon Cognito user pool ARN in the policy.
- C
Configure the API Gateway method to use an Amazon Cognito user pool authorizer.
- D
Write custom authentication logic in your Lambda function to validate the user's credentials.
Show answer and explanation
Correct answer: C
Explanation
To enforce authentication for API Gateway endpoints using Amazon Cognito, the recommended approach is to use an Amazon Cognito user pool authorizer. This authorizer validates the JWT tokens issued by the Cognito user pool and ensures that only authenticated users can access the protected endpoints. This approach is more secure and efficient compared to implementing custom authentication logic or using Lambda authorizers.
- A. Incorrect.
Incorrect: While Lambda authorizers can validate JWT tokens, using an Amazon Cognito user pool authorizer is a more streamlined and recommended approach for integrating with Amazon Cognito.
- B. Incorrect.
Incorrect: Resource-based policies on API Gateway are used for granting permissions to other AWS services or IAM users, but they cannot enforce authentication based on Amazon Cognito user pools.
- C. Correct.
Correct: Amazon Cognito user pool authorizers in API Gateway are specifically designed to validate JWT tokens issued by Cognito and enforce authentication for API requests.
- D. Incorrect.
Incorrect: Writing custom authentication logic in Lambda is not recommended for this use case, as it adds unnecessary complexity and duplicates functionality already provided by Cognito and API Gateway.