How to add cognito user pool authorizer to Lambda Proxy integration in Cloud Formation Template?

Question

I have the following cloud formation JSON template. This template is the default template provided by AWS for C#(Dotnet) Web API Lambda proxy integration.

{
  "AWSTemplateFormatVersion" : "2010-09-09",
  "Transform" : "AWS::Serverless-2016-10-31",
  "Description" : "An AWS Serverless Application that uses the ASP.NET Core framework running in Amazon Lambda.",

  "Parameters" : {
    "ShouldCreateBucket" : {
      "Type" : "String",        
      "AllowedValues" : ["true", "false"],
      "Description" : "If true then the S3 bucket that will be proxied will be created with the CloudFormation stack."
    },  
    "BucketName" : {
        "Type" : "String",
        "Description" : "Name of S3 bucket that will be proxied. If left blank a new table will be created.",
        "MinLength" : "0"
    }
  },

  "Conditions" : {
    "CreateS3Bucket" : {"Fn::Equals" : [{"Ref" : "ShouldCreateBucket"}, "true"]},
    "BucketNameGenerated" : {"Fn::Equals" : [{"Ref" : "BucketName"}, ""]}
  },

  "Resources" : {

    "ProxyFunction" : {
      "Type" : "AWS::Serverless::Function",
      "Properties": {
        "Handler": "DotnetLanmada::DotnetLanmada.LambdaEntryPoint::FunctionHandlerAsync",
        "Runtime": "dotnetcore2.0",
        "CodeUri": "",
        "MemorySize": 256,
        "Timeout": 30,
        "Role": null,
        "Policies": [ "AWSLambdaFullAccess" ],
        "Environment" : {
          "Variables" : {
            "AppS3Bucket" : { "Fn::If" : ["CreateS3Bucket", {"Ref":"Bucket"}, { "Ref" : "BucketName" } ] }
          }
        },
        "Events": {
          "PutResource": {
            "Type": "Api",
            "Properties": {
              "Path": "/{proxy+}",
              "Method": "ANY"
            }
          }
        }
      }
    },

    "Bucket" : {
        "Type" : "AWS::S3::Bucket",
        "Condition" : "CreateS3Bucket",
        "Properties" : {
            "BucketName" : { "Fn::If" : ["BucketNameGenerated", {"Ref" : "AWS::NoValue" }, { "Ref" : "BucketName" } ] }
        }
    }
  },

  "Outputs" : {
    "S3ProxyBucket" : {
        "Value" : { "Fn::If" : ["CreateS3Bucket", {"Ref":"Bucket"}, { "Ref" : "BucketName" } ] }
    }
  }
}

This template creates a Lambda function, API Gateway, and an S3 bucket. All the requests to API gateway are proxy-ed to the Lambda function. I want to authenticate all the requests to API gateway using an existing Cognito user pool. Basically, the API gateway will have a Cognito user pool authorizer and the proxy function is authorized with that. Since the API Gateway creation part is hidden in this template I have no clue how to add a Cognito user pool authorizer here.

Thanks in advance.

Typo alert: it's a lambda (yes - "b" before "d") - not just "lamda" .... — marc_s

Miles Miles · Accepted Answer · 2018-02-04T08:39:28

One way to achieve what you want is to export the ARN of your Lambda function, and then import it into your API Gateway stack.

To export your function's ARN, in your Outputs section add:

"Function": {
    "Value": ProxyFunction.Arn,
    "Export": {
        "Name": "ProxyFunction::Arn"
    }
}

You will also need to have an invocation permission for API Gateway to invoke your function. You can add something like this to your stack:

"LambdaInvocationPermission": {
    "Type": "AWS::Lambda::Permission",
    "Properties": {
        "Action": "lambda:InvokeFunction",
        "FunctionName": { "Fn::GetAtt" : [ "ProxyFunction", "Arn" ] },
        "Principal": "apigateway.amazonaws.com"
    }
}

Then in your API Gateway stack, you can reference your function's ARN with

{ "Fn::ImportValue" : "ProxyFunction::Arn" }

How to add cognito user pool authorizer to Lambda Proxy integration in Cloud Formation Template?

1 Answers