AWS Lambda Function URLs for Stateful MCP Servers
Short answer
C Create Lambda function URLs and enable a custom Streamable HTTP transport and SigV4. Implement AWS IAM authentication. Grant InvokeFunctionUrl permissions to authorized users and roles.
Question
The solution must be accessible to both internal applications and authorized third-party partners. The solution must use strict authentication and authorization controls.
Which additional steps will meet these requirements with the LEAST operational overhead?
Key Takeaways
The main trap is confusing 'least operational overhead' with 'most robust enterprise auth'. While Cognito (D) is powerful, Lambda Function URLs (C) offer native, zero-infrastructure HTTP endpoints with IAM integration, fitting the 'least overhead' constraint better.
This page explains how to deploy stateless Model Context Protocol (MCP) servers on AWS Lambda using Lambda Function URLs with SigV4 authentication to minimize operational overhead while maintaining strict security.
Common mistake: Candidates often choose Option D because they associate third-party access with OAuth/Cognito. However, the question explicitly demands the LEAST operational overhead, and Cognito setup is significantly more complex than enabling a Lambda Function URL with IAM.
Expert Analysis
The question requires exposing stateless MCP servers running on AWS Lambda to both internal and external partners with strict authentication, minimizing operational overhead. The Model Context Protocol (MCP) utilizes a "Streamable HTTP" transport for modern, stateless server interactions.
Option C is the correct answer because it leverages Lambda Function URLs. This feature provides a direct HTTPS endpoint for a single Lambda function without requiring an API Gateway or other services, thereby meeting the "least operational overhead" requirement. Crucially, Lambda Function URLs support SigV4 authentication (AWS IAM), which allows fine-grained access control via IAM policies (e.g., lambda:InvokeFunctionUrl), satisfying the strict security requirements for both internal and third-party users.
Option A suggests using the Lambda Invoke API directly. While this has low overhead, it does not expose an HTTP endpoint compatible with MCP clients, requiring significant client-side rework.
Option B proposes Amazon API Gateway REST APIs with API keys. REST APIs are legacy and do not natively support the Streamable HTTP transport pattern as elegantly as HTTP APIs or Function URLs. Furthermore, API Keys are less robust for managing complex authorization scenarios compared to IAM or Cognito.
Option D uses Amazon API Gateway HTTP APIs with Amazon Cognito for OAuth. While this supports third-party partners well, setting up Cognito introduces significant configuration and management overhead. Since the requirement is "least operational overhead," the managed simplicity of Lambda Function URLs with IAM (Option C) is superior to the full suite of API Gateway + Cognito (Option D).
Official Reference
- https://docs.aws.amazon.com/lambda/latest/dg/lambda-urls.html
- https://www.anthropic.com/news/model-context-protocol
- https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure-arns.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question asks for "least operational overhead" combined with "HTTP exposure", prioritize AWS-native simplified endpoints like Lambda Function URLs over full managed services like API Gateway unless specific features (like rate limiting or custom domains) are explicitly required. Always check if IAM can satisfy the auth requirement before jumping to Cognito.
Frequently Asked Questions
Why not use API Gateway for MCP servers?
Is SigV4 secure enough for third-party partners?
What is Streamable HTTP in MCP?
Community Votes
63% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 8 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 8
-
AndreyShne24 👍 5 Answered DI think D is the answer since the question states to support third-party partners, Cognito is good for these types of situations, C for example is good if it is AWS to AWS only in which the question doesn't explicitly say
-
eesa 👍 3 Answered CMCP servers stateless → Lambda es ideal Accesible a aplicaciones internas Y partners externos Autenticación y autorización estrictas LEAST operational overhead Mantener compatibilidad con MCP protocol
-
GiorgioGss 👍 3 Answered C"LEAST operational overhead"
-
Kimzia 👍 2 Answered Ait uses the native Lambda Invoke API to access the stateless MCP servers directly, while IAM authentication and InvokeFunction permissions provide strict access control for both internal applications and authorized third-party partners with the least operational overhead.
-
Kraftzman 👍 2 Answered CTo fulfill the requirements with the least operational overhead while providing strict security for your Model Context Protocol (MCP) servers, the most efficient solution is to leverage Lambda Function URLs.
Show 3 more comments
-
953bf6d 👍 1 Answered DCorrect answer: D. It preserves MCP compatibility while providing managed authentication and authorization for internal applications and external partners. Why D meets the requirements Streamable HTTP preserves MCP: It supports remote MCP communication over HTTP. A stateless implementation is suitable for the Lambda deployment described in the question. Cognito provides OAuth-based access: Clients obtain tokens, and API Gateway’s managed JWT authorizer validates them before allowing access to the Lambda-backed endpoints. AWS documents this Cognito and HTTP API integration. Scopes enforce authorization: Configure required OAuth scopes on API routes so a valid token alone is insufficient; it must also contain the appropriate permissions. This avoids building a custom token-validation service. The request path is: MCP client → API Gateway validates token and scopes → Lambda MCP server Why not the others? A: Explicitly requires a custom Lambda invocation transport. D instead uses MCP’s remote HTTP transport and managed token validation, making it the better fit for least operational overhead. B: Explicitly replaces MCP with ordinary HTTP requests, rather than exposing the existing tools through a compatible MCP transport. Streamable HTTP retains MCP semantics over HTTP. C: IAM authentication is not inherently insecure or incapable of supporting partners. However, this option explicitly requires custom transport and SigV4 integration; D offers the more suitable managed OAuth access pattern for the stated audience.
-
Naaser 👍 1 Answered CLowest Operational Overhead: Lambda Function URLs are a simpler way to provide dedicated HTTP(S) endpoints compared to managing Amazon API Gateway.MCP Compatibility: The Streamable HTTP transport is a core part of the Model Context Protocol. It allows for long-running connections or chunked data transfer, which is necessary for the protocol's communication patterns.Strong Security: Using AWS IAM (SigV4) authentication is the most robust way to secure the endpoint. It ensures that only specifically authorized AWS users, roles, or third-party partners (via cross-account roles) can invoke the tools.
-
Chibuzo1 👍 1 Answered CMCP servers as Lambda functions (stateless) MCP's modern Streamable HTTP transport is designed exactly for stateless server deployments — it maps cleanly to Lambda's request/response model. Options A and B don't use MCP-native transport, which means rearchitecting how clients communicate.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All AIP-C01 Questions
Access 110 questions with complete answers and detailed explanations.
View Full AIP-C01 Practice Test →