ExamPark
Course menuDVA-C03

Exams / DVA-C03 / API authorization and tokens / Question 2

DVA-C03 practice question: API authorization and tokens (2 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A payments service runs as Amazon ECS tasks that use an IAM role named payments-task.

It must call one method of an Amazon API Gateway REST API in the same account, and only tasks using that role may invoke the method. The team does not want to create or rotate any tokens, passwords or API keys.

Which TWO actions should the developer take? (Choose two.)

Choose two answers.

  1. A. Set the method's authorization type to AWS_IAM.
  2. B. Create an API key, attach it to a usage plan and place the key in the task definition's environment variables.
  3. C. Allow execute-api:Invoke on the method's ARN in the task role, and sign the service's requests with Signature Version 4.
  4. D. Create a Cognito user pool authorizer and send the task role's ARN in the Authorization header on each call.
  5. E. Add a VPC link to the method so that only traffic from the ECS service's subnets reaches the integration.
Show the answer and explanation

Answers: A, C

  • A. Right: Correct. With AWS_IAM, API Gateway checks the caller's IAM permissions on each request. Without it, IAM policies have no effect on the method and it stays open. Learn more: Controlling access with IAM permissions (opens in a new tab)
  • B. Wrong: API keys identify callers for throttling and quotas, not for authorization, and the key would be a secret that the team must create and rotate. This goes against the stated requirement. Learn more: Controlling access to REST APIs (opens in a new tab)
  • C. Right: Correct. The caller's role must be allowed to invoke the method, and each request must be signed with the role's temporary credentials. The AWS SDKs and signing libraries do this using the credentials that ECS provides to the task. Learn more: Controlling access with IAM permissions (opens in a new tab)
  • D. Wrong: A user pool authorizer expects a token issued by the user pool, and a role ARN is just text that anyone could copy. It would prove nothing about the caller.
  • E. Wrong: A VPC link lets API Gateway reach private backends; it does not control who can call the API. It does nothing to restrict callers to one role.

Explanation

IAM authorization needs two settings: the method must use the AWS_IAM authorization type, and the caller's role must be allowed execute-api:Invoke on the method and sign requests with Signature Version 4. No tokens or keys are created or rotated. API keys, user pool authorizers and VPC links do not identify an IAM role.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice API authorization and tokensAll API authorization and tokens questions

Want more on API authorization and tokens? The 5 full-length practice sets have 15 more API authorization and tokens questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets