Question

A developer is building a serverless REST API using Amazon API Gateway backed by AWS Lambda. Users sign in through an Amazon Cognito user pool, and the mobile app receives tokens after successful authentication. The API must reject any request that does not carry a valid, non-expired user identity, and the solution should require minimal custom code. Which approach should the developer implement?

Accepted Answer

Configure a Cognito user pool authorizer on API Gateway and have the client send the ID token in the Authorization header.

Answer

Pass the Cognito access token to the Lambda function and call GetUser on the Cognito Identity Provider API inside the handler to validate it.

Answer

Use a Cognito identity pool to exchange the user's credentials for temporary IAM credentials and sign each API request with SigV4.

Answer

Store the user's refresh token in the request body and validate it against Secrets Manager before invoking the Lambda function.