An API Gateway REST API must authorize requests using a custom JWT scheme that Cognito can't validate. What's the integration point for custom authorization logic?
A.A Lambda authorizer that returns an IAM policy document
Correct. Custom authorization logic lives in the authorizer Lambda.
B.An API Gateway usage plan
Usage plans throttle/quota API keys — not authentication.
C.A resource policy with a deny-all statement
Resource policies control principals/IPs/VPCs, not token validation.
D.An S3 bucket policy
S3 policies don't apply to API Gateway.
Why this answer
Lambda authorizers (custom authorizers) run a Lambda function on each request — inspect the token/header, then return an IAM policy (Allow/Deny) plus context. Ideal for bespoke token schemes Cognito authorizers don't support.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security