ExamPark
Course menuDVA-C03

Exams / DVA-C03 / API authorization and tokens / Question 1

DVA-C03 practice question: API authorization and tokens (1 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A logistics company exposes a REST API in Amazon API Gateway to carriers.

Carriers send opaque access tokens from the company's own identity provider, which is not Amazon Cognito and does not issue JWTs. The only way to check a token is to call the provider's introspection endpoint, and a carrier typically reuses one token for many calls within minutes. The company wants to keep introspection calls low.

Which solution meets these requirements?

Choose one answer.

  1. A. Create a Cognito user pool authorizer, and import each carrier's opaque access token into the user pool for validation.
  2. B. Create a Lambda authorizer that calls the introspection endpoint, returns an IAM policy and caches the result.
  3. C. Move the API to an HTTP API and add a JWT authorizer that points at the identity provider's issuer URL and audience.
  4. D. Create a usage plan and require each carrier to send its access token as the x-api-key header on every request.
Show the answer and explanation

Answer: B

  • A. Wrong: A Cognito user pool authorizer validates tokens that the user pool itself issued. Opaque tokens from another provider cannot be imported and checked this way, so every call would be rejected. Learn more: Controlling access to REST APIs (opens in a new tab)
  • B. Right: Correct. A Lambda authorizer can run any custom check, such as an HTTP call to the provider, and returns an IAM policy that allows or denies the call. Caching the returned policy means repeated calls with the same token do not call the introspection endpoint again. Learn more: Lambda authorizers for REST APIs (opens in a new tab)
  • C. Wrong: A JWT authorizer validates signed JWTs against the issuer's keys. The carriers' tokens are opaque, so there is no signature or claim set for it to check.
  • D. Wrong: Usage plans and API keys meter and throttle callers that are already authorized. They are not an authentication mechanism, and API Gateway would never check the token against the provider. Learn more: Controlling access to REST APIs (opens in a new tab)

Explanation

Opaque tokens that can be checked only by calling a provider's introspection endpoint need custom logic, which a Lambda authorizer provides. It returns an IAM policy, and enabling authorization caching stops repeat calls with the same token from reaching the provider. Cognito and JWT authorizers need tokens they can validate themselves, and API keys are for metering, not authorization.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice API authorization and tokensAll API authorization and tokens questions

Want more on API authorization and tokens? The 5 full-length practice sets have 15 more API authorization and tokens questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets