An application serves personalized content and its APIs must authenticate requests carrying JSON Web Tokens (JWTs) issued by a third-party identity provider such as Auth0. The authentication must happen at the API layer, without custom verification code in each microservice. Which AWS service handles JWT validation there?
Show answer and explanation
Answer: B
API Gateway HTTP APIs include a native JWT authorizer: you configure the issuer and audience, and the gateway fetches the identity provider's JWKS to verify the signature, expiry, and claims before the request ever reaches the backend integration. Authentication is centralized at the API layer, so microservices only receive verified identity context.
Why the other options are wrong
- A. SigV4 is AWS credential signing for calling AWS service APIs; it cannot validate Auth0-issued user tokens against your application's endpoints.
- C. A Lambda authorizer works, but it is precisely custom verification code that you must write, deploy, and maintain — and it adds a Lambda round trip to every request.
- D. AWS WAF is a layer-7 firewall for request filtering; it does not act as a token validator or an identity enforcement point for application APIs.