DVA-C02 Question 129
Select 2You are developing a serverless application on AWS that uses Amazon API Gateway to expose RESTful APIs and AWS Lambda to process requests. To authenticate API requests, you decide to use JSON Web Tokens (JWT) generated by a third-party identity provider (IdP). Which combination of steps should you take to authenticate and authorize API requests in this scenario?
- A
Configure an Amazon Cognito user pool as an authorizer in API Gateway and set up the third-party IdP to federate with Cognito.
- B
Implement a custom Lambda authorizer in API Gateway to validate the structure and signature of the incoming JWT.
- C
Use AWS Security Token Service (AWS STS) to validate the JWT and exchange it for temporary AWS credentials.
- D
Enable OAuth 2.0 scopes in API Gateway to handle JWT validation and restrict access based on the scopes.
- E
Validate the JWT directly in your Lambda function and use it to determine the user's identity.
Show answer and explanation
Correct answers: A, B
Explanation
To authenticate and authorize API requests using JWTs in API Gateway, you can use Amazon Cognito as an authorizer to handle JWT validation and federate with a third-party IdP. Alternatively, you can implement a custom Lambda authorizer for more control over the validation process. AWS STS and OAuth 2.0 scopes are not directly used for JWT validation in this context, and validating JWTs in the Lambda function is not a recommended practice due to efficiency concerns.
- A. Correct.
This is correct. Amazon Cognito can federate with third-party identity providers to validate JWTs and manage user authentication on your behalf. By configuring Cognito as an authorizer in API Gateway, you can offload the JWT validation and focus on business logic.
- B. Correct.
This is correct. A custom Lambda authorizer allows you to validate JWTs manually, checking their structure, signature, and claims. This is useful when you need fine-grained control over the validation process.
- C. Incorrect.
This is incorrect. AWS STS is used to generate temporary credentials for accessing AWS resources. It does not validate JWTs or handle user authentication.
- D. Incorrect.
This is incorrect. API Gateway does not natively handle JWT validation through OAuth 2.0 scopes. OAuth scopes are used for defining access permissions, but JWT validation requires a separate mechanism like Cognito or a Lambda authorizer.
- E. Incorrect.
This is incorrect. While you could validate JWTs directly in your Lambda function, this approach is not efficient or scalable. It’s better to delegate authentication tasks to API Gateway or Cognito to simplify your architecture.