Jeff’s Note #
Unlike generic exam dumps, ADH analyzes this scenario through the lens of a Real-World Lead Developer.
For DVA-C02 candidates, the confusion often lies in how to correctly handle authorization tokens versus API keys in API Gateway setups using Cognito. In production, this is about knowing exactly what credentials go in the Authorization header and how the API Gateway authorizer validates them. Let’s drill down.
The Certification Drill (Simulated Question) #
Scenario #
TechFlow Labs is building a customer service platform where multiple AWS Lambda functions call an Amazon API Gateway REST API to fetch user data. The API Gateway methods use an Amazon Cognito user pool authorizer for authentication. Each Lambda function sends the user ID in the Authorization header when invoking the API. However, when these Lambdas make GET requests, the API Gateway returns 403 Forbidden errors consistently.
The Requirement: #
Identify the correct fix to allow the Lambda functions’ GET requests to successfully authenticate and be authorized by API Gateway.
The Options #
- A) Modify the Lambda GET requests to include a valid API key in the Authorization header.
- B) Modify the Lambda GET requests to include a valid Cognito JWT token in the Authorization header.
- C) Update the API Gateway resource policy to allow the execute-api:Invoke action for the Lambdas.
- D) Modify the Lambda clients to send OPTIONS preflight requests ahead of the GET requests.
Google adsense #
leave a comment:
Correct Answer #
B
Quick Insight: The Developer Imperative #
The critical piece is that the Authorization header must carry a valid Cognito JWT token, not an API key or user ID. The Amazon Cognito authorizer verifies the JWT token’s signature and claims before permitting access. Without this token, the API Gateway treats the call as unauthorized and returns HTTP 403.
Content Locked: The Expert Analysis #
You’ve identified the answer. But do you know the implementation details that separate a Junior from a Senior?
The Expert’s Analysis #
Correct Answer #
Option B
The Winning Logic #
API Gateway with a Cognito user pool authorizer expects a valid JWT token in the Authorization header for authorization. This token is issued by the Cognito user pool after user authentication. Passing just the user ID, or an API key, does not satisfy the authorizer. The authorizer will reject and return a 403 Forbidden response if the token is absent or invalid.
-
Lambda functions invoking the API must first obtain valid Cognito tokens (ID or access tokens) and send them as:
Authorization: <JWT token> -
The resource policy (Option C) controls who can invoke the API at the resource level, but does not replace token-based authentication.
-
API keys (Option A) are supported by API Gateway, but are separate from Cognito authorizers and not required in this setup.
-
OPTIONS preflight requests (Option D) relate to CORS and do not solve authorization errors.
The Trap (Distractor Analysis) #
- Why not A? API keys are used for throttling or metering, not for Cognito-based auth. Sending an API key in Authorization will be ignored by the authorizer.
- Why not C? Resource policies enable network-level access control and do not replace JWT token validation. 403 here means token invalid or missing, not resource policy denial.
- Why not D? OPTIONS requests are part of CORS. This is irrelevant to token authentication failures causing 403 errors.
The Technical Blueprint #
# Sample curl command showing a valid token in Authorization header
curl -H "Authorization: eyJraWQiOiJrMjp1In0.eyJzdWIiOiIxMjM0..." \
https://api.example.com/prod/users
The Comparative Analysis #
| Option | API Complexity | Performance | Use Case |
|---|---|---|---|
| A | Low | Medium | API key auth — unrelated here |
| B | Standard JWT | High | Cognito token-based authorizer |
| C | Medium | Low | Resource policy for network |
| D | Low | N/A | Preflight for CORS only |
Real-World Application (Practitioner Insight) #
Exam Rule #
For the exam, always pick token-based Authorization when you see a Cognito user pool authorizer.
Real World #
In production, developers often forget the distinction between API keys and JWT tokens in headers. Always ensure your calling client presents the JWT token exactly as expected by API Gateway.
(CTA) Stop Guessing, Start Mastering #
Disclaimer
This is a study note based on simulated scenarios for the DVA-C02 exam.