Securing an API: Amazon Cognito, JWT authorization, Secrets Manager and KMS

A Sawa Express competitor posts a screenshot: a customer's name, phone number and address, read from the parcels API. Anyone can read any parcel, and even mark it delivered. And the SMS provider's key is written in the code. Patrick wants everything locked down before Monday. You create the customer and rider accounts in Amazon Cognito, and protect every API route with an API Gateway JWT authorizer: without a valid token, nothing gets through. In the function, you restrict status changes to riders, by reading their group in the token. Then you store the SMS key in AWS Secrets Manager, encrypted with an AWS KMS key, and find out the two permissions needed to read it: one on the secret, the other on the key. Finally, you open the API to the office's web dashboard, and to it alone, with CORS. The fourth lab of the AWS path for developers, which prepares you for the AWS Certified Developer - Associate certification (DVA-C02).