You are building APIs with API Gateway REST API and need to restrict certain resources so only registered users can access them. Tokens should expire automatically and be refreshable. How do you meet these requirements?

The correct answer is to create an Amazon Cognito user pool, configure the API Gateway Cognito Authorizer to use it, and rely on the user pool’s identity or access tokens. Amazon Cognito User Pools provide a secure user directory, authentication, and authorization for APIs. The Cognito Authorizer in API Gateway directly integrates with a user pool, validating the JWT tokens (ID or access tokens) issued by Cognito for authenticated users. These tokens have built-in expiration and can be refreshed, meeting the requirements. Incorrect options: An Amazon Cognito identity pool provides temporary AWS credentials for accessing other AWS services, not for authorizing API Gateway REST API calls directly. Maintaining a custom database for tokens and implementing a Lambda authorizer is a viable but more complex and less scalable solution compared to Cognito User Pools, which are purpose-built for this. Creating an IAM user for every API user is impractical for a large number of users, difficult to manage, and doesn't provide automatic token expiration or refresh capabilities.