A company runs a production web application that includes an Amazon API Gateway HTTP API which invokes an AWS Lambda function. The Lambda function processes requests and stores data in a database. The company wants integrated user authorization and already uses a third-party identity provider that issues OAuth tokens for other applications. Which solution meets these authorization requirements?

The correct solution leverages an API Gateway Lambda authorizer to validate OAuth tokens from the third-party identity provider. This is a standard and flexible pattern for integrating custom authorization logic with API Gateway, allowing the Lambda function to inspect the provided OAuth token and determine authorization based on the company's specific requirements. The web application is updated to acquire and send these tokens, completing the end-to-end flow. Incorrect options: Integrating with AWS Directory Service or IAM Identity Center directly as an API Gateway authorizer is not a native capability for OAuth token validation from arbitrary third-party identity providers in the way described. Directory Service is for managing directories, and while IAM Identity Center handles identity, it's not designed to act as a direct OAuth token validator for API Gateway in this manner. Using IAM Identity Center to retrieve STS tokens is for AWS resource access, not for authorizing API Gateway requests with third-party OAuth tokens. Creating IAM users and extracting request parameters from them is not how OAuth authorization works and would not validate the third-party OAuth tokens.