API Gateway security

Question 1

API Gateway security

Answer 1

• IAM permissions
  
  • sig v4 - credentials are signed and placed in headers
• resource policies - json policy on gateway to define who and what can access you resource
  
  • good for cross account access, filter for specific IP addresses
• Cognito user pools
• lambda authorizer - 3rd party authentication
  
  • jwt token (oath)
  • lambda evaluates and returns IAM policy for the user, result policy is cached