AWS Certified Developer – Associate — Question 112

A company is developing an application that will be accessed through the Amazon API Gateway REST API. Registered users should be the only ones who can access certain resources of this API. The token being used should expire automatically and needs to be refreshed periodically.

How can a developer meet these requirements?

Answer options

• A. Create an Amazon Cognito identity pool, configure the Amazon Cognito Authorizer in API Gateway, and use the temporary credentials generated by the identity pool.
• B. Create and maintain a database record for each user with a corresponding token and use an AWS Lambda authorizer in API Gateway.
• C. Create an Amazon Cognito user pool, configure the Cognito Authorizer in API Gateway, and use the identity or access token.
• D. Create an IAM user for each API user, attach an invoke permissions policy to the API, and use an IAM authorizer in API Gateway.

Correct answer: C

Explanation

The correct answer is C because using an Amazon Cognito user pool allows for user registration and token management, including automatic expiration and refresh. Option A uses identity pools, which are not suitable for user management in this context. Option B involves managing tokens manually, which adds unnecessary complexity, and Option D is not ideal as IAM users are not designed for access control in this manner.