Validate third-party OAuth tokens with an API Gateway Lambda authorizer

Why the Answer Is Correct

The company already has an identity provider issuing OAuth tokens, and the requirement is to authorise users in an integrated way rather than introduce a parallel system. An API Gateway Lambda authorizer is invoked on each API request and can validate the token issued by the external provider, returning an IAM policy that allows or denies the request, so the existing tokens become the basis for authorisation. Requiring the authorizer on all API routes ensures every endpoint is protected, and the web application change is limited to obtaining a token from the identity provider and passing it in the Authorization header. Because the authorizer is just a Lambda function, the validation logic can call whatever SDK or introspection endpoint the provider exposes, which is why this works with any third-party OAuth provider.

Why the Other Options Are Wrong

B: AWS Directory Service is a directory service, and it is not an API Gateway authorizer, so the described configuration does not exist. Adding SAML configuration for IAM Identity Center and registering the web application as a custom SAML application also forces the company onto AWS federation for a user base that already authenticates through the third-party provider, which is the opposite of an integrated approach. C: IAM Identity Center is integrated with API Gateway but it validates AWS STS tokens issued by AWS, not the third party's OAuth tokens, so the web application would have to obtain AWS tokens instead of the ones it already has, which changes the authentication model rather than integrating with it. D: IAM users with permissions to call the API are AWS credentials, not end-user identities, and extracting request parameters from IAM users and putting them in an Authorization header provides no authentication at all since the header content is attacker-controlled.

Community Comment Notes

The community voted 100 to 0 for A, and the top-voted comments linked the AWS blog on using Lambda authorizers with a third-party identity provider to secure API Gateway APIs, and noted that this pattern lets users access API Gateway resources with their third-party credentials without configuring additional services such as Amazon Cognito. Another commenter pointed out that Lambda authorizers can integrate with external providers including OAuth 2.0 and OpenID Connect.