As part of securing an API layer built on Amazon API gateway, a Solutions Architect has to authorize users who are currently authenticated by an existing identity provider. The users must be denied access for a period of one hour after three unsuccessful attempts.

Use AWS IAM authorization and add least-privileged permissions to each respective IAM role.

Use an API Gateway custom authorizer to invoke an AWS Lambda function to validate each user’s identity.

Use Amazon Cognito user pools to provide built-in user management.

Use Amazon Cognito user pools to integrate with external identity providers.