AWS › Amazon API Gateway

How does API Gateway handle authentication and authorization for incoming requests?

Intermediate

Answer

API Gateway supports multiple authorization methods including IAM based permissions, Amazon Cognito user pools for managing app users, and custom Lambda authorizers that let you write your own logic to validate tokens such as JSON Web Tokens before allowing a request to reach the backend.

aws apigateway create-authorizer --rest-api-id abc123 --name 'MyAuthorizer' --type TOKEN --authorizer-uri arn:aws:lambda:us-east-1:123456789012:function:authFunction

Real-world example A mobile banking app uses a Lambda authorizer that checks a customer's login token on every API call, rejecting the request immediately if the token is invalid or expired before it ever reaches the backend service.

Common follow-ups: What is the difference between a Lambda authorizer and Cognito user pool authorization?;How do you secure an API Gateway endpoint using API keys?

IAM;Amazon SageMaker & Machine Learning on AWS