1Z0-997-25 Question 17
Single answerYour company has created a serverless application on Oracle Cloud Infrastructure using Oracle Functions to process incoming HTTP requests. They configured an API Gateway to forward external requests to the function's endpoint. However, some requests are failing with 401 Unauthorized errors despite the gateway being properly configured to invoke the function. Which step must you verify or perform to ensure API Gateway correctly invokes the function with appropriate credentials?
- A
Configure a resource principal in the function� IAM policy and ensure that the API Gateway is passing the resource principal token to the function
- B
Set the API Gateway route to �ANONYMOUS� mode to allow any incoming request to call the function directly
- C
Disable authentication in API Gateway and let Oracle Functions handle authorization automatically
- D
Configure a custom identity provider in Oracle Functions to handle 3rd-party tokens rather than using resource principals
Show answer and explanation
Correct answer: A
Explanation
In Oracle Cloud Infrastructure, API Gateway can invoke Functions using resource principals. You must create an IAM policy that allows the resource principal associated with the API Gateway to invoke the function. The gateway includes an invocation token (resource principal token) when calling the serverless function, ensuring secure and authorized invocations. Refer to Oracle� documentation on 'Using Resource Principals with Oracle Functions' and 'Configuring API Gateway to Invoke Functions' for detailed best practices.
- A. Correct.
Correct. To invoke a function securely via API Gateway, you must configure a resource principal in the IAM policy associated with the function. The API Gateway then uses that resource principal token to authenticate with Oracle Functions. This is the standard and recommended approach for secure function invocation.
- B. Incorrect.
Incorrect. Setting the route to �ANONYMOUS� mode would bypass authentication entirely, which is insecure and does not solve the 401 errors. You still need the gateway to invoke the function using valid credentials.
- C. Incorrect.
Incorrect. Disabling authentication at the API Gateway level is not best practice. Oracle Functions require a valid invocation token when called from external services like API Gateway; removing security enforcement is not the correct solution.
- D. Incorrect.
Incorrect. While Oracle Functions can integrate with identity providers in some scenarios, the most straightforward and recommended method to invoke functions from API Gateway is to rely on Oracle resource principals rather than implementing a custom third-party identity solution.