A Lambda authorizer, previously known as a custom authorizer, is a dedicated Lambda function invoked by API Gateway *before* the request reaches the backend integration. This authorizer receives the incoming token, performs custom validation logic (e.g., JWT signature verification, expiration checks), and returns an IAM policy that either permits or denies access to the requested API resource. Crucially, API Gateway can cache the policy generated by the authorizer, significantly reducing latency and computational overhead for subsequent requests with the same valid token.
Why this answer
A Lambda authorizer (formerly custom authorizer) runs before the backend Lambda invocation, caching the JWT validation result for a configurable TTL (default 300 seconds). This avoids re-validating the token on every request, providing the lowest latency for token validation compared to validating inside the backend Lambda.
Exam trap
It is a common misconception that API Gateway request validation can handle JWT token validation, but it only validates structural format (e.g., header presence), not cryptographic signature verification.
How to eliminate wrong answers
Option A is wrong because a VPC Link connects to a private server inside a VPC, which adds network latency and complexity without any caching or pre-invocation validation benefit. Option B is wrong because validating the token inside the integrated Lambda function requires the backend to run on every request, even for invalid tokens, increasing latency and cost. Option C is wrong because API Gateway request validation only checks header presence and format (e.g., regex), not the cryptographic validity of a JWT token.