Exams / DVA-C02 / API authorisation and tokens / Question 1
DVA-C02 practice question: API authorisation and tokens (1 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A REST API in Amazon API Gateway is used by partner companies. The partners obtain opaque access tokens from a third-party OAuth provider, and the only way to validate a token is to call that provider's token introspection endpoint. Which authorisation option should the developer use?
Choose one answer.
- AA. An Amazon Cognito user pool authoriser configured with the partner's client ID.
- BB. A Lambda authoriser that calls the provider's introspection endpoint and returns an IAM policy.
- CC. IAM authorisation, with partners signing requests using the OAuth token as the secret key.
- DD. An API key in a usage plan, with the OAuth token sent in the x-api-key header.
Show the answer and explanation
Answer: B
- A. Wrong: A Cognito authoriser validates tokens issued by a Cognito user pool, not opaque tokens from another provider.
- B. Right: Correct. A Lambda authoriser can run any custom logic, such as calling an OAuth provider, and returns an Allow or Deny policy.
- C. Wrong: IAM authorisation needs requests signed with AWS credentials using SigV4. An OAuth token cannot be used to sign them.
- D. Wrong: API keys are for usage plans, throttling and quotas. AWS advises against using them for authentication or authorisation.
Explanation
Lambda authorisers let you plug custom authentication into API Gateway. A TOKEN or REQUEST authoriser receives the caller's token or request details, can call an OAuth or SAML provider, and returns a principal ID and an IAM policy. API Gateway can cache the result to reduce repeat calls.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.