Cognito user pool authorizer in API Gateway

What it means

When you configure an Amazon Cognito user pool authorizer in API Gateway, you are telling API Gateway to:

1. Use Amazon Cognito to authenticate incoming requests.
2. Validate each request’s JWT (JSON Web Token) against the Cognito user pool.
3. Allow or deny requests based on whether the token is valid.

This is a secure way to protect your APIs without writing custom authentication logic.

How it works

1. User signs in via Amazon Cognito.
2. Cognito returns an ID token and/or access token.
3. The client includes the token in the HTTP request to API Gateway (in the Authorization header).
4. API Gateway uses the Cognito user pool authorizer to validate the token before invoking your backend.

Step-by-Step Implementation

Step 1 — Create a Cognito User Pool

• Go to Amazon Cognito → Manage User Pools → Create a user pool.
• Configure sign-in options (email, username, etc.).
• Save and note the User Pool ID and App Client ID.

Step 2 — Create an API in API Gateway

• Go to API Gateway → Create API (REST or HTTP API).
• Create resources and methods (GET, POST, etc.).

Step 3 — Configure Cognito Authorizer in API Gateway

1. Select your API in API Gateway.
2. Go to Authorizers → Create New Authorizer.
3. Choose Cognito as the authorizer type.
4. Give it a name.
5. Select your Cognito User Pool.
6. Save.

Step 4 — Attach the Authorizer to Your Methods

• Select a method (e.g., GET).
• Under Method Request, set Authorization to your Cognito authorizer.
• Deploy your API.

Step 5 — Use the Authorizer

When a client requests the API:

• They must include the JWT token in the request header:

Authorization: 

• API Gateway will call Cognito to validate the token before allowing access.

Example Flow

1. User signs in → gets token from Cognito.
2. Client calls API Gateway with token in header.
3. API Gateway checks token via Cognito authorizer.
4. If valid → request proceeds. If invalid → request is denied.

✅ Key Benefit: You get built-in authentication without needing to write custom code.
⚡ Best practice: Combine with AWS WAF for additional protection against attacks.

Question:

A developer is troubleshooting an application. The application includes several AWS Lambda functions that invoke an Amazon API Gateway API. The API Gateway’s method request is set up to use an Amazon Cognito authorizer for authentication. All the Lambda functions pass the user ID as part of the Authorization header to the API Gateway API. The API Gateway API returns a 403 status code for all GET requests.
How should the developer resolve this issue?

Options:

• A. Modify the client GET request to include a valid API key in the Authorization header.
• B. Modify the client GET request to include a valid token in the Authorization header.
• C. Update the resource policy for the API Gateway API to allow the execute-api:Invoke action.
• D. Modify the client to send an OPTIONS preflight request before the GET request.

Correct Answer:
B. Modify the client GET request to include a valid token in the Authorization header.

Explanation:
The 403 status code indicates that the request is forbidden due to authentication issues. The Lambda functions are passing the user ID, but the API Gateway requires a valid token (such as a JWT token from Cognito) in the Authorization header for authentication. Modifying the client to include a valid token will resolve the issue.

Question:

A company is using Amazon API Gateway for its REST APIs in an AWS account. A developer wants to allow only IAM users from another AWS account to access the APIs.
Which combination of steps should the developer take to meet these requirements? (Select TWO.)

Options:

• A. Create an IAM permission policy. Attach the policy to each IAM user. Set the method authorization type for the APIs to AWS_IAM. Use Signature Version 4 to sign the API requests.
• B. Create an Amazon Cognito user pool. Add each IAM user to the user pool. Set the method authorization type for the APIs to COGNITO_USER_POOLS. Authenticate by using the IAM credentials in Amazon Cognito. Add the ID token to the request headers.
• C. Create an Amazon Cognito identity pool. Add each IAM user to the identity pool. Set the method authorization type for the APIs to COGNITO_USER_POOLS. Authenticate using the IAM credentials in Amazon Cognito. Add the access token to the request headers.
• D. Create a resource policy for the APIs that allows access for each IAM user only.
• E. Create an Amazon Cognito authorizer for the APIs that allows access for each IAM user only. Set the method authorization type for the APIs to COGNITO_USER_POOLS.

Correct Answers:
A. Create an IAM permission policy. Attach the policy to each IAM user. Set the method authorization type for the APIs to AWS_IAM. Use Signature Version 4 to sign the API requests.
D. Create a resource policy for the APIs that allows access for each IAM user only.

Explanation:
To allow only IAM users from another AWS account to access the APIs, you can create an IAM permission policy and attach it to each IAM user. Setting the method authorization type to AWS_IAM ensures that the API Gateway uses IAM roles and policies for authentication. Additionally, creating a resource policy for the APIs that allows access for each IAM user only further restricts access.

Question:

A company is creating a REST service using an Amazon API Gateway with AWS Lambda integration. The service runs different versions for testing purposes. What would be the BEST way to accomplish this?

Options:

• A. Use an x-Version header to denote which version is being called and pass that header to the Lambda function(s).
• B. Create an API Gateway Lambda authorizer to route API clients to the correct API version.
• C. Create an API Gateway resource policy to isolate versions and provide context to the Lambda function(s).
• D. Deploy the API versions as unique stages with unique endpoints and use stage variables to provide further context.

Correct Answer:
D. Deploy the API versions as unique stages with unique endpoints and use stage variables to provide further context.

Explanation:
Deploying different API versions as unique stages in API Gateway allows for isolated environments for each version. Using unique endpoints and stage variables provides flexibility and clear separation between versions, making it easier to manage and test different versions of the service.