This blog post explains it:
The sample code is this:
'use strict';
exports.handler = function(event, context) {
console.log("{'Cookie':event['Cookie']}");
var date = new Date();
// Get Unix milliseconds at current time plus 365 days
date.setTime(+ date + (365 \* 86400000)); //24 \* 60 \* 60 \* 100
// Generate a random cookie string
var cookieVal = Math.random().toString(36).substring(7);
var cookieString = "myCookie="+cookieVal+"; domain=my.domain;
expires="+date.toGMTString()+";";
context.done(null, {"Cookie": cookieString});
};
If using callbacks, then the response needs to be along the lines of:
callback(null, {
"statusCode": 200,
"headers": { "Set-Cookie": myCookie=cookieVal; domain=my.domain;
expires="+date.toGMTString()+"; },
"body": "..."
});
But you also need to update the APIG to allow the cookie response as per the blog post:
In the API Gateway console, go to the GET Method page and choose Method Response. Expand the default 200 HTTP status, and choose Add Header. Add a new header called “Set-Cookie.”
On the GET Method page, choose Integration Response. Under the Header
Mappings section of the default 200 HTTP status, choose the pencil
icon to edit the “Set-Cookie” header. In the mapping value section,
put:
integration.response.body.Cookie
Make sure to save the header by choosing the check icon!
APIG currently has a restriction that each header can only exist once in the response. This means that only one cookie can be set at a time.