A REST API on Amazon API Gateway must accept requests bearing JSON Web Tokens issued by an Amazon Cognito user pool. The team wants API Gateway to verify each token's signature and expiry and to authorise access by checking OAuth scopes in the token, with no custom code to write or maintain. Which authoriser should the team configure on the API methods?
- AAn AWS Identity and Access Management authorisation type that signs each request with SigV4 so the caller proves its identity using IAM credentials.
- BA Cognito user pool authoriser that validates the token against the configured user pool and authorises the method using the token's OAuth scopes. Correct
- CA request-based Lambda authoriser that reads custom headers and returns an IAM policy, with the function calling the Cognito API to introspect the token on each request.
- DA token-based Lambda authoriser whose function decodes the JSON Web Token and verifies the signature using a downloaded public key before returning a policy.
Why A is wrong: IAM authorisation validates SigV4 signatures from IAM principals, not bearer JSON Web Tokens from a user pool, so it cannot check token signature, expiry, or OAuth scopes.
Why B is correct: A Cognito user pool authoriser natively verifies the JSON Web Token signature and expiry against the user pool and authorises by matching method scopes, requiring no custom code.
Why C is wrong: A Lambda authoriser could be coded to do this, but it forces the team to write and maintain validation code, which the requirement explicitly rules out.
Why D is wrong: A token Lambda authoriser can validate JSON Web Tokens but still requires the team to author and maintain the verification logic, which conflicts with the no-code requirement.