AWS Certified Generative AI Developer - Professional AIP-C01

By Amazon · Question Mode

QuestionQ32

AI Safety, Security, and Governance

A company is building a new AI-powered application that must integrate with several specialized tools. The tools currently operate as Model Context Protocol (MCP) servers on developers’ local machines and retain no state between invocations. The company intends to deploy each MCP server as an AWS Lambda function to support the production application.

The solution must be reachable by both internal applications and authorized third-party partners, and it must enforce strict authentication and authorization controls.

Which additional steps will satisfy these requirements with the LEAST operational overhead?

Explanation

Amazon API Gateway HTTP APIs can integrate directly with Lambda functions and support OAuth 2.0/OpenID Connect authorization. Amazon Cognito can provide OAuth tokens for internal and third-party clients, and API Gateway can validate those tokens before forwarding MCP Streamable HTTP requests to Lambda. This preserves the MCP-compatible transport while using managed token validation and scope- or claim-based access control, avoiding custom transports and direct IAM credential administration for partner clients.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!