DVA-C02 Question 131
Single answerA developer is building a serverless application using AWS API Gateway and AWS Lambda. The application needs to authenticate users using JSON Web Tokens (JWT) issued by a third-party identity provider (IdP). How can the developer configure API Gateway to validate the JWTs and authorize access to the Lambda function?
- A
Use an API Gateway Lambda authorizer to validate the JWT and authorize access.
- B
Configure an AWS STS AssumeRoleWithWebIdentity API call to validate the JWT directly.
- C
Use the API Gateway built-in JWT authorizer to validate the token against the third-party IdP.
- D
Implement custom JWT validation logic inside the Lambda function.
Show answer and explanation
Correct answer: A
Explanation
To validate JWTs issued by a third-party IdP and authorize access to resources behind API Gateway, you should use a Lambda authorizer. This allows you to implement custom authentication and authorization logic, such as verifying the token's signature, checking claims, and validating the token against the IdP. AWS STS and custom logic within the Lambda function are not appropriate solutions in this scenario.
- A. Correct.
Correct. An API Gateway Lambda authorizer can be used to validate JWTs. The Lambda authorizer is a flexible way to implement custom authentication and authorization logic, such as verifying tokens issued by a third-party IdP.
- B. Incorrect.
Incorrect. AWS STS AssumeRoleWithWebIdentity is used to assume roles with web identity tokens issued by services like Amazon Cognito, but it cannot validate JWTs for API Gateway requests directly.
- C. Incorrect.
Incorrect. As of now, API Gateway does not have a built-in JWT authorizer for third-party IdPs; a Lambda authorizer is required to handle custom JWT validation.
- D. Incorrect.
Incorrect. While you could implement custom JWT validation logic in the Lambda function, this approach is not recommended because it tightly couples authentication logic with business logic, making the application harder to maintain and scale.