DVA-C02 Question 132
Single answerA developer is building a web application that uses Amazon API Gateway to expose backend APIs. The APIs require authentication using JSON Web Tokens (JWT) issued by a third-party identity provider (IdP). How should the developer configure the API Gateway to validate the JWTs and ensure only authenticated requests are allowed?
- A
Use an AWS Lambda authorizer to parse and validate the JWT token.
- B
Enable IAM authentication in the API Gateway and configure the roles to validate the JWT.
- C
Configure a resource policy in API Gateway to validate the JWT against the third-party IdP.
- D
Use Amazon Cognito user pools to validate the JWT and integrate it with the API Gateway.
Show answer and explanation
Correct answer: A
Explanation
To validate JWTs issued by a third-party IdP, the recommended approach is to use an AWS Lambda authorizer. The Lambda authorizer is invoked by API Gateway to process the incoming request, validate the JWT, and determine whether the request is authorized. This approach allows developers to implement custom logic for verifying the token, such as checking its signature, expiration, and required claims.
- A. Correct.
Correct. An AWS Lambda authorizer can be used to parse and validate JWT tokens issued by third-party IdPs. The Lambda function can handle the validation logic to ensure the token is valid and contains the required claims.
- B. Incorrect.
Incorrect. IAM authentication is not used for validating JWTs from external IdPs. IAM roles are designed for AWS service access control rather than JWT validation.
- C. Incorrect.
Incorrect. API Gateway resource policies control access to APIs based on IP addresses or AWS accounts, but they cannot validate JWT tokens directly.
- D. Incorrect.
Incorrect. Amazon Cognito user pools are used to manage user authentication and issue JWTs, but they are not suitable for validating JWTs issued by third-party IdPs.