A developer exposes a web API via an internet-facing Application Load Balancer (ALB) using an HTTPS listener and has configured an Amazon Cognito user pool. The developer wants to ensure every request to the API is authenticated through Cognito. What should be done?

The authenticate-cognito action on an ALB listener directly integrates with Amazon Cognito user pools, offloading authentication from the application. Setting OnUnauthenticatedRequest to "deny" ensures that only authenticated requests are forwarded to the target group, effectively enforcing authentication for all API access. Returning a fixed 401 response (option 1) is insufficient as it doesn't actually perform authentication; it only checks for a header. Using API Gateway (option 3) is a valid approach for API management and authentication, but the question asks what should be done with the existing ALB setup, and the authenticate-cognito action is a direct and efficient solution within the ALB itself. A Lambda target group (option 4) would work but adds unnecessary complexity and latency compared to the native ALB integration.