API Gateway OAuth 2.0 with External IdP: Lambda Authorizer
A company is designing a new application on AWS that uses Amazon API Gateway and AWS Lambda to expose a RESTful API. The API must authenticate requests using OAuth 2.0 with an external identity provider (IdP). The company wants to offload the authentication logic to the API Gateway. Which API Gateway feature should they use?
Quick Answer
The answer is to configure a Lambda authorizer to validate the OAuth 2.0 token. This is correct because API Gateway’s custom Lambda authorizer allows you to offload authentication logic by invoking a Lambda function that validates the token from an external identity provider (IdP) against OAuth 2.0 standards, returning an IAM policy to grant or deny access. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this scenario tests your ability to distinguish between API Gateway’s authentication mechanisms, often setting traps where Cognito User Pools might seem correct but fail when the IdP is external and not Amazon Cognito. A common memory tip is to remember that “external IdP” always points to a custom Lambda authorizer, not a built-in Cognito integration. For the exam, think “external equals Lambda” to avoid the trap of selecting Cognito or misreading the requirement as needing a VPC Link or usage plan.
⚠ Common exam trap
It's easy for candidates to confuse API keys (which identify the client application) with OAuth 2.0 tokens (which authenticate the end user), leading them to incorrectly select usage plans with API keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Lambda authorizer to validate the OAuth 2.0 token.
A Lambda authorizer (formerly known as a custom authorizer) allows API Gateway to call a Lambda function that validates the OAuth 2.0 token (e.g., JWT) from the external IdP. This offloads authentication logic from the backend Lambda to API Gateway, enabling centralized token validation before the request reaches the integration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use API Gateway's WebSocket API.
Why it's wrong here
WebSocket is for bidirectional streaming, not REST authentication.
- ✗
Enable API Gateway's VPC Link.
Why it's wrong here
VPC Link is for integrating with private VPC resources.
- ✓
Configure a Lambda authorizer to validate the OAuth 2.0 token.
Why this is correct
Lambda authorizer can call the IdP to validate tokens and return an IAM policy.
- ✗
Use usage plans with API keys.
Why it's wrong here
API keys are for throttling, not authentication.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is designing a new serverless application that uses Amazon API Gateway and AWS Lambda. The application must authenticate users using a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The company wants to offload authentication to the API Gateway. Which solution should the architect recommend?
medium- ✓ A.Use an API Gateway COGNITO_USER_POOLS authorizer with Cognito configured as an OIDC client to the third-party IdP
- B.Use an API Gateway COGNITO_USER_POOLS authorizer
- C.Use an API Gateway Lambda authorizer
- D.Use an API Gateway IAM authorizer
Why A: It uses Amazon Cognito as an OIDC client to the third-party IdP, allowing API Gateway's COGNITO_USER_POOLS authorizer to validate tokens from the IdP without custom code. This offloads authentication entirely to API Gateway, as the authorizer checks the JWT token against the Cognito user pool, which trusts the IdP's OIDC tokens. The architecture meets the requirement of using a third-party IdP while keeping the serverless application simple and managed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.