An API Gateway REST API must authorize requests using JWTs from a custom OIDC provider (not Cognito). What enforces token validation before requests reach the backend?
A.A Cognito authorizer
Cognito authorizers only accept Cognito-issued tokens.
B.A Lambda authorizer (request- or token-based) validating the JWT and returning an IAM policy
Correct. Custom token validation at the edge of the API.
C.WAF rules inspecting the Authorization header
WAF filters requests; it doesn't mint auth decisions as IAM policies.
D.IAM authentication on the method
IAM auth requires SigV4 credentials — not OIDC JWTs.
Why this answer
Lambda authorizers run custom auth logic — validate any JWT/OIDC token and return an IAM policy + context. REST APIs also offer native JWT authorizers only on HTTP APIs; for arbitrary token logic on REST, Lambda authorizer is the answer. Cognito authorizers only work with Cognito user pools.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security