Aws Lambda/Api-Gateway/Cognito working together

Question

Im playing around with Lambda trying to use it to authenticate a web app. Im using lambdAuth as a starter to get things going. https://github.com/danilop/LambdAuth

I want to have an api-gateway service that first authorizes a member, returning the token from cognito. All the subsequent services in api-gateway then somehow needs to accept what was returned from cognito to allow access to the service, and fail without it. Im kinda confused with how to use cognito. Im assuming you restrict your api-gateway services by adding the AWS_IAM tag to the Authorization of your service, but I dont know how to then call that service...?

In the current implementation of LambdAuth, it does all of this client side (in the browser), calling the lambdas directly. It gets the AWS.config.credentials, adds the IdentityId and Logins that came back from cognito to it and then calls the lambda function that requires you to be logged in. How will this work when calling api-gateway instead of lambda. How do i take what came back from cognito, and add it to my service call in order to pass that AWS_IAM authorization?

Any help will be appreciated, or if im missing the boat completely thats also possible...

Mark Mercurio Mark Mercurio · Accepted Answer · 2016-04-20T18:11:27

For the lambda functions handling auth behind API Gateway, you would need them to be unauthorized, as your users have not logged in yet.

For the lambda functions behind API Gateway that ARE authorized, you will need to pass in the credentials you acquired from Cognito when instantiating your client.

It looks like you are doing developer authentication, so when you get a Cognito Token from your backend/lambda functions, in your app you will need to get credentials still:

AWS.config.credentials = new AWS.CognitoIdentityCredentials({
   IdentityPoolId: 'IDENTITY_POOL_ID',
   IdentityId: 'IDENTITY_ID_RETURNED_FROM_YOUR_PROVIDER',
   Logins: {
      'cognito-identity.amazonaws.com': 'TOKEN_RETURNED_FROM_YOUR_API'
   }
});

Then, from your credentials you will need the access key, secret key, and session key to instantiate your API Gateway Client:

Instantiating your API Gateway Client:

var client = apigClientFactory.newClient({ 
accessKey: ACCESS_KEY, 
secretKey: SECRET_KEY, 
sessionToken: SESSION_TOKEN });

Aws Lambda/Api-Gateway/Cognito working together

1 Answers