An internet-facing Amazon API Gateway stage must not remain open to anonymous callers. Which approach best secures application access at the API layer?
Select an answer to reveal the explanation.
Short Explanation
An open API stage is a front door with no lock. Cognito authorizers or IAM auth on API Gateway make callers prove who they are before methods run. Polite User-Agents, weekly URL billboards, or turning off HTTPS are not authorization.
Full Explanation
API Gateway supports Cognito user pool authorizers, IAM SigV2/SigV4 style authentication, Lambda authorizers, and other controls so methods are not anonymously invokable. Leaving authorization as NONE exposes backend integrations to unauthenticated internet traffic. Obscuring URLs or disabling TLS does not provide authentication or authorization at the API edge and weakens transport security.