ByteWorks exposes a multi‑tenant REST API on Amazon API Gateway (REST API) that must accept JWTs issued by an external IdP (Okta). Authorization must evaluate tenant claims, return an IAM policy, and pass custom context to the backend. The team wants to reduce authorization latency via caching. What should they implement?

A Lambda authorizer (token-based) is the correct choice because it allows custom logic to validate JWT signatures and tenant claims, generate an IAM policy for fine-grained access control, and pass custom context to the backend. Enabling authorizer result caching significantly reduces authorization latency by storing the policy for a specified TTL, and an identity cache key ensures caching is specific to each user's token. Incorrect options: An API Gateway Cognito user pool authorizer cannot directly trust Okta tokens without federation; it's designed for Cognito User Pools. Migrating to API Gateway HTTP APIs is unnecessary as REST APIs support Lambda authorizers, and HTTP API JWT authorizers don't directly return IAM policies or custom context in the same way. Relying solely on API keys and backend validation would bypass API Gateway's authorization capabilities, increase backend load, and not address the requirement for an IAM policy or custom context at the API Gateway level.