DOP-C02 · Question #248
A company groups its AWS accounts in OUs in an organization in AWS Organizations. The company has deployed a set of Amazon API Gateway APIs in one of the Organizations accounts. The APIs are bound…
The correct answer is B. Create a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token. E. Verify the identity of the requester by using Signature Version 4 to sign client requests by using. To resolve the "anonymous is not authorized" error for an API Gateway with no existing authentication and restrict access to specific OU principals, the API needs an authentication mechanism.
Question
A company groups its AWS accounts in OUs in an organization in AWS Organizations. The company has deployed a set of Amazon API Gateway APIs in one of the Organizations accounts. The APIs are bound to the account's VPC and have no existing authentication mechanism. Only principals in a specific OU can have permissions to invoke the APIs. The company applies the following policy to the API Gateway interface VPC endpoint:
The company also updates the API Gateway resource policies to deny invocations that do not come through the interface VPC endpoint. After the updates, the following error message appears during attempts to use the interface VPC endpoint URL to invoke an API: "User:
anonymous is not authorized." Which combination of steps will solve this problem? (Choose two.)
Options
- AEnable IAM authentication on all API methods by setting AWS JAM as the authorization method.
- BCreate a token-based AWS Lambda authorizer that passes the caller's identity in a bearer token.
- CCreate a request parameter-based AWS Lambda authorizer that passes the caller's identity in a
- DUse Amazon Cognito user pools as the authorizer to control access to the API.
- EVerify the identity of the requester by using Signature Version 4 to sign client requests by using
How the community answered
(37 responses)- A22% (8)
- B62% (23)
- C11% (4)
- D5% (2)
Why each option
To resolve the "anonymous is not authorized" error for an API Gateway with no existing authentication and restrict access to specific OU principals, the API needs an authentication mechanism.
AWS JAM is not a recognized or valid authorization method for Amazon API Gateway.
Creating a token-based AWS Lambda authorizer allows for custom authentication logic to validate tokens, identify callers, and enforce access based on their association with a specific organizational unit, thereby resolving the unauthorized access error.
The choice is incomplete, but a request parameter-based Lambda authorizer is generally less common for passing identity than a token-based one, and its core functionality is already covered by option B as a Lambda authorizer.
Amazon Cognito user pools are primarily designed for application user management and less directly suited for authorizing AWS IAM principals based on their AWS Organizations OU membership.
Verifying the identity by using Signature Version 4 to sign client requests means clients use AWS IAM credentials, allowing the API Gateway to use IAM authentication and resource policies to control access for AWS principals, including those from a specific OU.
Concept tested: API Gateway authorization with Lambda authorizers and IAM
Source: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html
Topics
Community Discussion
No community discussion yet for this question.