A team is building a new public HTTP backend that only needs simple proxy routing to AWS Lambda functions, JWT authorisation against an existing OpenID Connect provider, and the lowest possible per-request cost and latency. It does not need request or response transformation, API keys with usage plans, or private VPC link integrations. Which Amazon API Gateway choice best fits these requirements?
- ABuild a REST API and attach a Lambda authoriser that calls the OpenID Connect provider on every request to validate the incoming token.
- BBuild a WebSocket API and validate the OpenID Connect token in the connect route before allowing the client to invoke any Lambda function.
- CBuild an HTTP API with a built-in JWT authoriser pointing at the OpenID Connect provider and Lambda proxy integrations for the routes. Correct
- DBuild a REST API as a private endpoint behind a VPC link and rely on the resource policy to restrict which callers may reach each method.
Why A is wrong: A REST API with a Lambda authoriser would work, but REST APIs cost more per request and add the authoriser invocation latency the simpler option avoids.
Why B is wrong: WebSocket APIs target persistent two-way messaging, not stateless request-response HTTP, so they add needless complexity for a simple proxy backend.
Why C is correct: HTTP APIs offer native JWT authorisers and Lambda proxy routes at lower cost and latency than REST APIs, matching every stated requirement directly.
Why D is wrong: A private REST API plus VPC link adds the private integration the team explicitly does not need and still carries the higher REST per-request price.