SAA-C03 Design Secure Architectures Practice Question
A public API for a image sharing application is deployed on API Gateway. Clients must authenticate with standards-based tokens issued by an external OpenID Connect provider. Which authorization mechanism should be used? The design must avoid adding custom operational scripts.
⚠ Common exam trap
Many exam-takers confuse API keys (simple identification) with token-based authentication (JWT/OIDC), or incorrectly assume IAM authorization can be used for external identity federation without custom Lambda authorizers or STS-based token exchange.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
JWT authorizer configured for the OpenID Connect issuer
C is correct because the scenario requires standards-based token authentication from an external OpenID Connect (OIDC) provider, and API Gateway's JWT authorizer natively validates JWTs issued by OIDC providers without requiring custom code. This authorizer verifies the token's signature, expiry, and issuer against the OIDC discovery endpoint, meeting the requirement to avoid custom operational scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A VPC endpoint policy
Why it's wrong here
A VPC endpoint policy is a resource-based policy that governs which principals and actions are permitted through a private network connection, such as an AWS PrivateLink or gateway endpoint. It only applies to traffic routed through that VPC endpoint and does not evaluate user identity, OIDC tokens, or bearer credentials. Because the API is public and accessed over the internet, an endpoint policy would not affect authentication at all and cannot replace an API Gateway authorizer.
- ✗
API keys only
Why it's wrong here
API keys in Amazon API Gateway are designed for identifying a client for usage plans, quotas, and throttling, not for authenticating individual users. They are static, long-lived tokens that can be easily shared or extracted, and they carry no information about the user's identity, group, or OIDC claims. An API key alone does not validate a user's credentials, so it cannot provide secure authentication for a public-facing image sharing application with diverse internet users.
- ✓
JWT authorizer configured for the OpenID Connect issuer
Why this is correct
A JWT authorizer configured for the OpenID Connect issuer is the correct choice because API Gateway can automatically fetch the OIDC provider's JSON Web Key Set (JWKS) to validate the JWT signature, expiry, issuer, and audience. This allows the API to authenticate users who received tokens from a trusted OIDC-compatible identity provider (such as Amazon Cognito or Auth0) without managing a custom Lambda authorizer or session state. It also supports scopes and claims for fine-grained authorization, making it a low-operational-overhead and secure solution for public internet users.
- ✗
IAM authorization for all internet users
Why it's wrong here
IAM authorization for API Gateway relies on AWS Signer (SigV4) requests signed with AWS access key and secret key, and it is designed for AWS principals such as IAM users, roles, or federated identities using STS. Internet users of a public image sharing application generally do not have AWS credentials, and distributing long-lived AWS access keys to them is a severe security risk. The IAM authorizer validates IAM policies against the caller's AWS identity, not the OIDC claims of the application user, so it is inappropriate for this authentication use case.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.