DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attach an IAM policy to the API Gateway resource that allows only the Cognito user pool ARN.

  Why it's wrong here

  Attaching an IAM policy to an API Gateway resource is designed to control access for AWS IAM principals (users, roles) or AWS services, not to authenticate individual end-users from a Cognito User Pool. IAM policies operate by evaluating the identity of the caller against defined permissions, but they lack the capability to interpret and validate a JSON Web Token (JWT) issued by a Cognito User Pool for end-user authentication.

• ✓

  Use a Cognito User Pool authorizer in API Gateway.

  Why this is correct

  The Cognito User Pool authorizer in API Gateway is the purpose-built, native solution for validating JWTs issued by Amazon Cognito User Pools. It automatically inspects the `Authorization` header for a valid JWT, verifies its signature against the user pool's public keys, checks its expiration, and confirms the issuer. Upon successful validation, API Gateway allows the request to proceed to the backend integration, often passing decoded token claims for application use.

• ✗

  Use an API Gateway resource policy that allows access only from the Cognito user pool.

  Why it's wrong here

  An API Gateway resource policy defines high-level access controls for the API itself, typically based on source IP addresses, VPC endpoints, or specific AWS IAM principals. This policy acts as a firewall-like mechanism, determining who can invoke the API at a broad level, but it does not possess the functionality to authenticate individual end-users by validating their specific JWTs issued by a Cognito User Pool.

• ✗

  Use a Lambda authorizer that validates the JWT token against the user pool.

  Why it's wrong here

  While technically feasible, using a Lambda authorizer to validate a JWT token against a Cognito User Pool introduces unnecessary complexity, latency, and operational overhead. This approach requires writing and maintaining custom Lambda code to perform the same JWT validation steps (signature, expiration, issuer checks) that API Gateway's native Cognito User Pool authorizer handles automatically. The built-in authorizer is more efficient and cost-effective for this specific use case.