Serverless AuthZ/AuthN with Lambda@Edge and CloudFront

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Design scalable and loosely coupled architectures.

Short answer

A Configure Amazon Cognito for authentication, implement Lambda@Edge for authorization, and configure Amazon CloudFront to serve the web application globally.

Question

A company wants to restrict access to the content of its web application. The company needs to protect the content by using authorization techniques that are available on AWS. The company also wants to implement a serverless architecture for authorization and authentication that has low login latency. The solution must integrate with the web application and serve web content globally. The application currently has a small user base, but the company expects the application's user base to increase. Which solution will meet these requirements?
  1. Configure Amazon Cognito for authentication. Implement Lambda@Edge for authorization. Configure Amazon CloudFront to serve the web application globally. Correct Answer
  2. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement AWS Lambda for authorization. Use an Application Load Balancer to serve the web application globally.
  3. Configure Amazon Cognito for authentication. Implement AWS Lambda for authorization. Use Amazon S3 Transfer Acceleration to serve the web application globally.
  4. Configure AWS Directory Service for Microsoft Active Directory for authentication. Implement Lambda@Edge for authorization. Use AWS Elastic Beanstalk to serve the web application globally.

Key Takeaways

It tests the understanding that Lambda@Edge is required to execute authorization logic at the edge (CloudFront) to minimize latency, while Cognito handles global identity management.

This question addresses the design of a globally accessible, serverless web application using Amazon Cognito for authentication and Lambda@Edge for authorization via CloudFront.

Common mistake: Many candidates incorrectly choose options using AWS Lambda or Application Load Balancers, failing to recognize that standard Lambda lacks the low-latency edge distribution capabilities of Lambda@Edge for global content serving.

Expert Analysis

Why the Answer Is Correct

Option A is the only solution that meets all technical constraints. Amazon Cognito provides managed, highly available authentication suitable for small to large user bases. Crucially, Lambda@Edge allows the company to implement custom authorization logic (e.g., checking JWTs or session tokens) directly at CloudFront edge locations. This ensures that access restrictions are enforced before content is served, minimizing latency for global users. CloudFront is the native service for serving web content globally with low latency.

Why the Other Options Are Wrong

Option B uses an Application Load Balancer, which terminates traffic at regional endpoints rather than a global edge network, resulting in higher latency. It also relies on standard AWS Lambda for authorization, which adds cold start and routing delays compared to Lambda@Edge. Option C uses S3 Transfer Acceleration, which optimizes upload speeds but does not provide the sophisticated authorization framework needed to restrict access based on complex rules; it is primarily for data transfer. Option D suffers from the same architectural flaws as B, using Elastic Beanstalk (regional compute) instead of a CDN-based edge architecture.

Community Comment Notes

The community consensus strongly supports Option A. As user Hkayne noted, the requirement to "Serve content globally" points directly to the use of Amazon CloudFront. Another commenter, KennethNg923, highlighted the pairing of Cognito for authentication and Lambda@Edge for authorization as the key pattern for this scenario. These comments reinforce the architectural decision to push logic to the edge.

Official Reference

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see 'serve content globally' combined with 'authorization', immediately look for CloudFront + Lambda@Edge. Standard Lambda is regional and too slow for edge-level access control decisions.

Frequently Asked Questions

Why can't I use standard AWS Lambda for authorization?

Standard Lambda runs in specific regions. For global low-latency access, Lambda@Edge executes code at CloudFront edge locations closer to the user.

Is S3 Transfer Acceleration suitable for authorization?

No, S3 Transfer Acceleration is designed to speed up file uploads to S3, not to manage user access policies or authentication flows.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Hkayne 👍 4 Answered A
    Serve content globally means the use of Cloudfront
  2. KennethNg923 👍 3
    Authen: Cognito Globally: Lambda@Edge + cloudfront
  3. Danges 👍 2 Answered A
    Implementación a nivel global ==> AWS Cloud Front
  4. Salilgen 👍 1 Answered A
    https://aws.amazon.com/blogs/networking-and-content-delivery/authorizationedge-how-to-use-lambdaedge-and-json-web-tokens-to-enhance-web-application-security/

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide