DOP-C02 · Question #457
A company deployed an Amazon CloudFront distribution that accepts requests and routes to an Amazon API Gateway HTTP API. During a recent security audit, the company discovered that requests from the…
The correct answer is D. Implement a custom header in the CloudFront distribution. Implement an AWS Lambda authorizer. To restrict direct access to API Gateway, add a custom header in the CloudFront distribution origin request and use a Lambda authorizer in API Gateway to validate that header. Only requests routed through CloudFront will include this header. This is the AWS-recommended pattern…
Question
A company deployed an Amazon CloudFront distribution that accepts requests and routes to an Amazon API Gateway HTTP API. During a recent security audit, the company discovered that requests from the internet could reach the HTTP API without using the CloudFront distribution. A DevOps engineer must ensure that connections to the HTTP API use the CloudFront distribution. Which solution will meet these requirements?
Options
- AEnable VPC Flow Logs to identify requests that reach the HTTP API.
- BDeploy AWS WAF in front of the CloudFront distribution.
- CImplement an identity-based policy on the CloudFront distribution that requires authentication to
- DImplement a custom header in the CloudFront distribution. Implement an AWS Lambda authorizer
How the community answered
(32 responses)- A19% (6)
- B3% (1)
- C6% (2)
- D72% (23)
Explanation
To restrict direct access to API Gateway, add a custom header in the CloudFront distribution origin request and use a Lambda authorizer in API Gateway to validate that header. Only requests routed through CloudFront will include this header. This is the AWS-recommended pattern in "Secure your APIs behind CloudFront using custom headers and Lambda authorizers."
Topics
Community Discussion
No community discussion yet for this question.