John is a software contractor and is working on a web application. Since the budget is limited and the schedule is tight, he decides to implement it using API gateway and Lambda so that he does not need to consider the server management, scalability, etc. The customer has raised concerns that the APIs should be kept secure and there should be mechanisms to control the access to API endpoints. Which below method can be used to help secure the API?

Answer options:

A.Attach a resource policy to the API Gateway API, which controls access to the API Gateway resources. Access can be controlled by IAM condition elements, including conditions on AWS account, source VPC, etc.
B.Use IAM permissions to control access to the API Gateway component. For example, in order to call a deployed API, the API caller must be granted permission to perform required IAM actions supported by the API execution component of API Gateway.
C.Use a Lambda function as the authorizer. When a client calls the API, the API Gateway either supplies the authorization token that is extracted from a specified request header for the token-based authorizer or it passes in the incoming request parameters as the input to the request parameters-based authorizer Lambda function.
D.Use an Amazon Cognito user pool to control who can access the API in Amazon API Gateway. You need to use the Amazon Cognito console, CLI/SDK, or API to create a user pool. Then, in the API Gateway, create an API Gateway authorizer with the chosen user pool.
E.All the above options are correct.

Correct Answer – E
 
Multiple mechanisms can be used to control access to the API in the API gateway. And several methods can be used together to implement a very granular and secure application. https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-to-api.html is an introduction to the methods.
The below mechanisms can be chosen.
Resource policies let you create resource-based policies to allow or deny access to your APIs and methods from the specified source IP addresses or VPC endpoints. It can be configured in the API Gateway console:
Standard AWS IAM roles and policies offer flexible and robust access controls that can be applied to an entire API or individual methods.
The below is an IAM policy example of calling the Lambda function:
Lambda authorizers are Lambda functions that control access to REST API methods using bearer token authentication and information described by headers, paths, query strings, stage variables, or context variables request parameters.
In the API Gateway console, lambda authorizers can be created in the below place.
Amazon Cognito user pools let you create customizable authentication and authorization solutions for your REST APIs.
As a result, option E is correct.