using cognito for authentication and custom authorizer for authorization

Question

I have an serverless application which uses AWS Cognito, Lambda, and API Gateway. The user signs in using AWS Cognito (with external identity provider) for user authentication and authorization. The API gateway uses Cognito Authorizer to secure access to the lambda function.

The initial use case is simple, any request sent to API Gateway need to be authenticated with Cognito, and they are authorized to invoke the lambda function. As long as they can sign in, they can invoke the lambda.

Now I want to change the authorization. Even if the user is able to authenticate with Cognito, they must contain certain scopes in order to be authorized to invoke the lambda. These scopes can be fetch or checked in an external authz service. Cognito authorizer on the API gateway do not allow me to implement custom logic to call external authz service.

What is the recommended way to handle this?

Answer 1

You can use lambda authorizer for this use case.

In your lambda you can first authenticate your incoming token (example) and once authentication is successful you can check authorization scopes using authz service.