Properly Authorize REST API Calls with AWS Cognito Access Tokens

Answer: A and D.

Option A is CORRECT because the first step to integrating API Gateway with AWS Cognito is to create a new Cognito User Pool authorizer on the API.

Option B is incorrect because the Cognito User Pool authorizer must be created and not the Identity Pool.

Option C is incorrect because passing identity claims to the backend is used with identity tokens, not access tokens.

Option D is CORRECT because OAuth Scopes must be specified on the API method so that they can be compared against scopes that are claimed in the incoming token.

Reference:

To properly authorize a call to one of the REST API methods using an access token in AWS Cognito, the following steps need to be taken:

1. Create a COGNITO_USER_POOLS authorizer: An authorizer is used to authenticate the identity of the user making the request to the API Gateway. In this case, a COGNITO_USER_POOLS authorizer should be created to authenticate the user against the AWS Cognito user pool. The authorizer will then return an IAM policy that specifies what the user is authorized to do.

2. Add the $context.authorizer.claims.email expression in the Integration Request of the API: After creating the authorizer, the $context.authorizer.claims.email expression should be added to the Integration Request of the API. This is necessary to pass the email identity claim of the user to the backend service. The email identity claim can be used by the backend service to identify the user making the request.

3. Configure a single-space separated list of OAuth Scopes on the API method: OAuth Scopes are used to define the level of access that a user has to a resource. To configure a single-space separated list of OAuth scopes on the API method, the following steps should be taken:

a) Go to the API Gateway console and select the API method that needs to be authorized. b) Click on the Method Request card. c) Scroll down to the Authorization Settings section. d) Select the radio button that says "AWS_IAM" for the Authorization type. e) In the OAuth Scopes field, enter a single-space separated list of the scopes that are required to access the API method. f) Click the Save button to save the changes.

4. Create a COGNITO_IDENTITY_POOLS authorizer (not required in this case): A COGNITO_IDENTITY_POOLS authorizer is used to authenticate the identity of the user against a Cognito identity pool. However, this is not required in this case as the user management is already being done using AWS Cognito user pools.

In conclusion, the required combination of steps to properly authorize a call to one of the REST API methods using an access token with AWS Cognito are:

1. Create a COGNITO_USER_POOLS authorizer.
2. Add the $context.authorizer.claims.email expression in the Integration Request of the API to pass the email identity claim to the backend.
3. Configure a single-space separated list of OAuth Scopes on the API method.