On the same API deployment, /health should allow anonymous clients while /admin must require a specific access scope after authentication. How is that modeled?
Select an answer to reveal the explanation.
Short Explanation
After the front door checks ID, each hallway sets its own visitor rules—anonymous for /health, a required scope for /admin. Authorization is per route, not a second gateway.
Full Explanation
After authentication, each API Gateway route can require AUTHENTICATION_ONLY, ANY_OF a list of access scopes, or ANONYMOUS. A public health path can be anonymous while /admin demands a scope returned by the authorizer or JWT. Authorization is route-level and does not require a second gateway.