Unauthorized callers should be rejected before a city grants Lambda runs for a protected API. Where should JWT validation happen?
Select an answer to reveal the explanation.
Short Explanation
Check badges at the front desk—API Gateway—before anyone walks into the Lambda office. Cognito/JWT/Lambda authorizers stop junk callers early. Validating only after DynamoDB work wastes money and still feels late.
Full Explanation
API Gateway authorizers (Cognito authorizers, JWT authorizers, or Lambda authorizers) enforce authentication and authorization at the edge before integration with Lambda. That prevents unauthorized invocations and keeps authN out of late business-logic paths. Validating only after expensive work, returning success for missing tokens, or fetching JWTs from public storage are incorrect patterns.