Unauthorized callers should be rejected before a city grants Lambda runs for a protected API. Where should JWT validation happen?
Select an answer to reveal the explanation.
Short Explanation
Check badges at the front desk—API Gateway—before anyone walks into the Lambda office. Cognito/JWT/Lambda authorizers stop junk callers early. Validating only after DynamoDB work wastes money and still feels late.
Full Explanation
Unauthorized callers should be rejected before a city grants Lambda runs for a protected API. Perform JWT validation at API Gateway with a Cognito authorizer, JWT authorizer, or Lambda authorizer so unauthenticated or invalid tokens never invoke the function, never query DynamoDB, and never incur business-logic cost. Edge rejection is both a security and a cost-control measure for public municipal APIs.
Validating only inside Lambda after business logic has already queried DynamoDB wastes capacity and widens the attack surface. Returning HTTP 200 with an empty body when the token is missing hides failures and still invokes the backend path that produced that response pattern. Storing JWTs in a public S3 bucket for Lambda to download on cold start is not an authorizer and publishes credentials material.
Exam caveat: authorizers should check signature, issuer, audience, and expiry; defense in depth can still re-check claims in the function for sensitive operations, but the gate belongs at the API edge first. Operational check: invoke the API without a token and with an invalid token, confirm API Gateway returns 401/403 without Lambda invocations in metrics, then succeed with a valid Cognito JWT.