DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure the API Gateway method to use the Lambda authorizer.

  Why this is correct

  After creating and configuring a Lambda authorizer, the crucial next step is to associate it with the specific API Gateway methods that require authorization. This configuration tells API Gateway to invoke the designated Lambda authorizer function before forwarding the request to the backend integration, ensuring that the incoming request's identity or token is validated. Without this explicit link, the authorizer would exist but never be utilized by the API endpoint.

• ✗

  Return a JSON Web Token (JWT) from the authorizer function.

  Why it's wrong here

  A Lambda authorizer's primary responsibility is to determine whether a client is authorized to invoke a specific API Gateway method. To communicate this decision back to API Gateway, the authorizer function must return an IAM policy document, not a JSON Web Token (JWT). The IAM policy explicitly grants or denies access to the requested resource, allowing API Gateway to enforce the authorization outcome. Returning a JWT would be an incorrect response format and would cause API Gateway to reject the authorizer's output.

• ✓

  Create a Lambda function that validates the token and returns an IAM policy.

  Why this is correct

  The fundamental component of a Lambda authorizer is a custom Lambda function responsible for authenticating and authorizing API requests. This function receives an identity token (e.g., a JWT or custom token) from the incoming request, validates its authenticity and claims, and then constructs and returns an IAM policy document. This policy explicitly specifies which API Gateway resources the caller is permitted or denied access to, enabling fine-grained authorization control.

• ✓

  Grant API Gateway permission to invoke the Lambda authorizer function.

  Why this is correct

  For API Gateway to successfully invoke the custom Lambda authorizer function, explicit permissions must be granted. This typically involves adding a resource-based policy to the Lambda authorizer function, allowing the `apigateway.amazonaws.com` service principal to perform the `lambda:InvokeFunction` action. Without this permission, API Gateway would be unable to call the authorizer, resulting in authorization failures for all protected API methods.

• ✗

  Generate an API key and distribute it to clients.

  Why it's wrong here

  Generating and distributing API keys is a mechanism primarily used with API Gateway usage plans to meter and throttle client access, or for simple identification. While API keys can be used for basic client identification, they do not inherently provide robust authentication or authorization capabilities like a Lambda authorizer. Lambda authorizers are designed for custom token-based authentication and complex authorization logic, making API keys an insufficient and distinct security control for this specific requirement.

Go deeper

Related to this question