SAA-C03 Question 102
Select 3You are designing an application that allows users to upload images and retrieve them using a REST API. You want to use Amazon API Gateway to manage the API and ensure scalability, security, and monitoring. The image data is stored in an S3 bucket, and you want to minimize operational overhead while ensuring that only authenticated users can access the images. Which combination of actions should you take to meet these requirements?
- A
Use Amazon API Gateway to create a REST API and integrate it with the S3 bucket using an HTTP proxy integration.
- B
Enable AWS IAM authorization in Amazon API Gateway and configure IAM policies to restrict access to the S3 bucket.
- C
Use Amazon API Gateway to create a REST API and integrate it with AWS Lambda to retrieve images from the S3 bucket.
- D
Enable Amazon Cognito user pools for API Gateway to handle authentication and authorization.
- E
Use API Gateway usage plans to throttle requests and monitor API usage.
Show answer and explanation
Correct answers: B, D, E
Explanation
To meet the requirements of the scenario, you should use API Gateway with AWS IAM authorization to securely manage access to the S3 bucket. Amazon Cognito can handle user authentication, ensuring that only authenticated users can access the API. Additionally, API Gateway usage plans allow you to throttle requests and monitor usage, reducing operational overhead and ensuring scalability. Direct HTTP proxy integration or Lambda-based solutions introduce unnecessary complexity in this scenario.
- A. Incorrect.
Using HTTP proxy integration directly with the S3 bucket would bypass many of the security and authentication benefits provided by API Gateway. This approach is not ideal when you need to ensure that only authenticated users can access the images.
- B. Correct.
Enabling AWS IAM authorization and using IAM policies to limit access to the S3 bucket ensures that only authorized users can access the bucket. This approach integrates well with other AWS services for security and access management.
- C. Incorrect.
Using AWS Lambda is not necessary in this case since you can directly control access to the S3 bucket through API Gateway and IAM authorization without adding extra operational overhead.
- D. Correct.
Amazon Cognito user pools can handle user authentication and pass tokens to API Gateway, which is a secure and scalable method to authenticate and authorize users.
- E. Correct.
API Gateway usage plans allow you to throttle requests and monitor API usage, helping ensure scalability and manageability of your application.