Skip to content

README.md

Latest commit

 

History

History
38 lines (32 loc) · 2.28 KB

README.md

File metadata and controls

38 lines (32 loc) · 2.28 KB
Raw

Sample AWS API Gateway Lambda Authorizer

A lambda authorizer provides custom authorization for API Endpoints exposed through Amazon API Gateway. This authorizer makes sure that API requests:

  • Contain a Bearer token (JWT) generated by your Custom Authorization Server
  • And the "uid" (user id claim) in the JWT matches the API request /api/v1/users/{userid} parameter. This ensures that users can only update their own profile and settings. This is done by explicitly whitelisting allowed methods:
    // allow update own profile
    policy.allowMethod(AuthPolicy.HttpVerb.POST, '/api/v1/users/' + uid);
    // allow change own password
    policy.allowMethod(AuthPolicy.HttpVerb.POST, '/api/v1/users/' + uid + '/credentials/*');

Dependencies

We use the library Okta JWT Verifier for Node.js to validate the token. And upon validation generate the aws-auth-policy for Amazon API Gateway.

Deployment

Step 1. Build

  1. Clone this repository and cd into /api/byob-api-proxy-lambda-authorizer-sample/
  2. rm -rf node_modules/ && npm install --production
  3. npm run zip will create a source bundle and place it in the /dist folder. You will need this zip file in the next steps, below.

Step 2. Create Lambda function using the AWS Lambda Console/UI

  1. Click Create Function
  2. Select Author from scratch
  3. Provide a value for Function name
  4. Runtime = Node.js 10.x
  5. Click Create Function (This will automatically create an AMI role. But you can also select an existing one with the correct permissions if you have one)
  6. In the Code entry type field, select Upload a .zip file and upload the previously generated zip file
  7. Add Environment variables:
NAME VALUE
AUD api://default (or whichever value you configured as "Audience" in your AuthorizationServer)
CLIENT_ID (the client_id of your application configured in Okta)
ISSUER The "issuer" value of your AuthorizationServer (e.g. https://acme.okta.com/oauth2/default)

Step 3.

Create an Authorizer for your API (Amazon API Gateway) using this Lambda function