SAP-C02 Q343 · Security

Question

A Solutions Architect wants to make sure that only AWS users or roles with suitable permissions can access a new Amazon API Gateway endpoint. The Solutions Architect wants an endto-end view of each request to analyze the latency of the request and create service maps. How can the Solutions Architect design the API Gateway access control and perform request inspections?

Accepted Answer

This answer satisfies both requirements precisely:

**Requirement 1: Access control for IAM users/roles**
- Setting authorization to **AWS_IAM** on the API Gateway method is the native, built-in mechanism for IAM-based access control.
- Granting **execute-api:Invoke** permission on the REST API resource allows fine-grained control over who can call which methods.
- Callers sign requests with **AWS Signature Version 4 (SigV4)**, which is the standard AWS authentication mechanism. API Gateway validates the signature against IAM policies automatically — no custom code needed.

**Requirement 2: End-to-end latency analysis and service maps**
- **AWS X-Ray** is purpose-built for distributed tracing. It provides:
  - End-to-end view of each request across services
  - Latency breakdown per segmen

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips