SAA-C03 Design Secure Architectures Practice Question
A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used?
⚠ Common exam trap
Many exam-takers confuse API keys (simple identification) with authentication, or assume IAM authorization is required for all API Gateway endpoints, overlooking the purpose-built JWT authorizer for federated OIDC tokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
JWT authorizer configured for the OpenID Connect issuer
API Gateway's JWT authorizer natively validates JSON Web Tokens (JWTs) issued by an external OpenID Connect (OIDC) provider. It verifies the token's signature, expiry, and issuer against the OIDC provider's JWKS endpoint, enabling standards-based authentication without custom Lambda code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A VPC endpoint policy
Why it's wrong here
A VPC endpoint policy governs access to the API through a VPC endpoint, controlling which principals and actions can use that private connection. It does nothing to authenticate individual application users on the public internet, and it cannot validate OIDC tokens or establish user identity. It is an authorization mechanism for network-level access, not a user authentication mechanism.
- ✗
API keys only
Why it's wrong here
API keys issued by API Gateway identify the calling client application for usage plans and throttling quotas, but they are shared secrets that can be extracted and reused. They do not verify an end user's identity, carry no claims about the user, and provide no support for standard federation or OIDC token validation. In a public image-sharing app, API keys alone leave the API open to any client that obtains a key, making them unsuitable for secure user authentication.
- ✓
JWT authorizer configured for the OpenID Connect issuer
Why this is correct
A JWT authorizer configured with the OpenID Connect issuer validates the JSON Web Token signature, expiry, and issuer at the API Gateway edge before allowing the request. This offloads authentication so the backend can trust claims such as the user's unique subject identifier and custom scopes without managing sessions or cryptographic verification code. It is the most appropriate, operationally lightweight option for authenticating external OIDC-based users on a public API.
- ✗
IAM authorization for all internet users
Why it's wrong here
IAM authorization on API Gateway requires the caller to sign requests with AWS credentials (SigV4) and is designed for AWS principals like EC2 roles or Lambda functions. Internet users of a public image-sharing app typically do not have AWS IAM credentials, and exposing temporary AWS credentials to every end user is both insecure and operationally unmanageable. It also lacks built-in support for OIDC identity federation for arbitrary public users.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.