Using AWS Lambda Authorizer in API Gateway

Question

I have my WEB API's hosted in Docker. My Angular client will send a JWT token to access any of these API's. I wanted to make use of AWS API Gateway feature to add an Authorization check before calling the API client requested. From the docs I see that we can leverage the Lambda Authorizer concept to Achieve this. But then again I though why using Lambda Authorizer when I can come up with an DOT NET CORE API which can validate the user.

Does my Lambda Gateway makes sense for my case?
If it does, what would be the output of the lambda Authorizer? A simple true/false which says the the Token is valid or not?

I see that this is what the response should/might look like. How this should translate to in my case

{
              "policyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Action": "execute-api:Invoke",
                    "Resource": [
                      "arn:aws:execute-api:us-east-1:1234567:myapiId/staging/POST/*"
                    ],
                    "Effect": "Allow"
                  }
                ]
              },
              "principalId": "Foo"
            }

What should happen in API gateway after the Lambda Authorizer executed ? Who calls my actual API which is requested by the client?

Thales Minussi Thales Minussi · Accepted Answer · 2019-08-23T11:36:45

If you are using a Lambda Authorizer, returning an Allow or Deny Policy is what you are looking for.

This essentially grants API Gateway permissions to invoke the underlying target. I know it sounds weird at a first glance, but that's how it works. Think of an Allow policy as a true return statement (credentials matched) kind of thing whilst a Deny policy is more of a false return statement (credentials didn't match / not enough permissions based on your rules, etc).

To get you off ground, you can simply copy/paste the code available at the docs and modify the authentication way to your liking (the docs show an example using a header with Allow or Deny values, which is definitely not what you want, that's just meant for the sake of an example).

So, back to your question by enumerating all the answers:

Yes, but it's called a Lambda Authorizer instead of a Lambda Gateway
Either an Allow or Deny policy for valid/invalid tokens respectively.
If the Lambda Authorizer responds with an Allow policy, it will then invoke the target (which can be a Lambda function, an SNS Topic, an HTTP endpoint - this is likely your case - and so on). The authorizer will just act as an interceptor and decide whether to proxy the call to the target or not.

Using AWS Lambda Authorizer in API Gateway

4 Answers