Package: aws-solutions-constructs.aws-cognito-apigateway-lambda
aws-cognito-apigateway-lambda module---All classes are under active development and subject to non-backward compatible changes or removal in any
future version. These are not subject to theSemantic Versioningmodel.
This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.Reference Documentation:https://docs.aws.amazon.com/solutions/latest/constructs/LanguagePackagePythonaws_solutions_constructs.aws_cognito_apigateway_lambdaTypescript@aws-solutions-constructs/aws-cognito-apigateway-lambdaJavasoftware.amazon.awsconstructs.services.cognitoapigatewaylambdaOverviewThis AWS Solutions Construct implements an Amazon Cognito securing an Amazon API Gateway Lambda backed REST APIs pattern.Here is a minimal deployable pattern definition:Typescriptimport{Construct}from'constructs';import{Stack,StackProps}from'aws-cdk-lib';import{CognitoToApiGatewayToLambda}from'@aws-solutions-constructs/aws-cognito-apigateway-lambda';import*aslambdafrom'aws-cdk-lib/aws-lambda';newCognitoToApiGatewayToLambda(this,'test-cognito-apigateway-lambda',{lambdaFunctionProps:{code:lambda.Code.fromAsset(`lambda`),runtime:lambda.Runtime.NODEJS_16_X,handler:'index.handler'}});Pythonfromaws_solutions_constructs.aws_cognito_apigateway_lambdaimportCognitoToApiGatewayToLambdafromaws_cdkimport(aws_lambdaas_lambda,Stack)fromconstructsimportConstructCognitoToApiGatewayToLambda(self,'test-cognito-apigateway-lambda',lambda_function_props=_lambda.FunctionProps(code=_lambda.Code.from_asset('lambda'),runtime=_lambda.Runtime.PYTHON_3_9,handler='index.handler'))Javaimportsoftware.constructs.Construct;importsoftware.amazon.awscdk.Stack;importsoftware.amazon.awscdk.StackProps;importsoftware.amazon.awscdk.services.lambda.*;importsoftware.amazon.awscdk.services.lambda.Runtime;importsoftware.amazon.awsconstructs.services.cognitoapigatewaylambda.*;newCognitoToApiGatewayToLambda(this,"test-cognito-apigateway-lambda",newCognitoToApiGatewayToLambdaProps.Builder().lambdaFunctionProps(newFunctionProps.Builder().runtime(Runtime.NODEJS_16_X).code(Code.fromAsset("lambda")).handler("index.handler").build()).build());If you are defining resources and methods on your API (e.g. proxy = false), then you must call addAuthorizers() after the API is fully defined to ensure every method is protected. Here is an example:Typescriptimport{Construct}from'constructs';import{Stack,StackProps}from'aws-cdk-lib';import{CognitoToApiGatewayToLambda}from'@aws-solutions-constructs/aws-cognito-apigateway-lambda';import*aslambdafrom'aws-cdk-lib/aws-lambda';constconstruct=newCognitoToApiGatewayToLambda(this,'test-cognito-apigateway-lambda',{lambdaFunctionProps:{code:lambda.Code.fromAsset(`lambda`),runtime:lambda.Runtime.NODEJS_16_X,handler:'index.handler'},apiGatewayProps:{proxy:false}});constresource=construct.apiGateway.root.addResource('foobar');resource.addMethod('POST');//MandatorytocallthismethodtoApplytheCognitoAuthorizersonallAPImethodsconstruct.addAuthorizers();Pythonfromaws_solutions_constructs.aws_cognito_apigateway_lambdaimportCognitoToApiGatewayToLambdafromaws_cdkimport(aws_lambdaas_lambda,aws_apigatewayasapi,Stack)fromconstructsimportConstructfromtypingimportAny# Overriding LambdaRestApiProps with type Anygateway_props=dict[Any,Any]construct=CognitoToApiGatewayToLambda(self,'test-cognito-apigateway-lambda',lambda_function_props=_lambda.FunctionProps(code=_lambda.Code.from_asset('lambda'),runtime=_lambda.Runtime.PYTHON_3_9,handler='index.handler'),api_gateway_props=gateway_props(proxy=False))resource=construct.api_gateway.root.add_resource('foobar')resource.add_method('POST')# Mandatory to call this method to Apply the Cognito Authorizers on all API methodsconstruct.add_authorizers()Javaimportsoftware.constructs.Construct;importjava.util.HashMap;importjava.util.Map;importjava.util.Optional;importsoftware.amazon.awscdk.*;importsoftware.amazon.awscdk.services.lambda.*;importsoftware.amazon.awscdk.services.lambda.Runtime;importsoftware.amazon.awscdk.services.apigateway.IResource;importsoftware.amazon.awsconstructs.services.cognitoapigatewaylambda.*;// Overriding LambdaRestApiProps with type AnyMap<String,Optional<?>>gatewayProps=newHashMap<String,Optional<?>>();gatewayProps.put("proxy",Optional.of(false));finalCognitoToApiGatewayToLambdaconstruct=newCognitoToApiGatewayToLambda(this,"test-cognito-apigateway-lambda",newCognitoToApiGatewayToLambdaProps.Builder().lambdaFunctionProps(newFunctionProps.Builder().runtime(Runtime.NODEJS_16_X).code(Code.fromAsset("lambda")).handler("index.handler").build()).apiGatewayProps(gatewayProps).build());finalIResourceresource=construct.getApiGateway().getRoot().addResource("foobar");resource.addMethod("POST");// Mandatory to call this method to Apply the Cognito Authorizers on all API methodsconstruct.addAuthorizers();Pattern Construct PropsNameTypeDescriptionexistingLambdaObj?lambda.FunctionExisting instance of Lambda Function object, providing both this andlambdaFunctionPropswill cause an error.lambdaFunctionProps?lambda.FunctionPropsUser provided props to override the default props for the Lambda function.apiGatewayProps?api.LambdaRestApiPropsOptional user provided props to override the default props for API GatewaycognitoUserPoolProps?cognito.UserPoolPropsOptional user provided props to override the default props for Cognito User PoolcognitoUserPoolClientProps?cognito.UserPoolClientPropsOptional user provided props to override the default props for Cognito User Pool ClientlogGroupProps?logs.LogGroupPropsUser provided props to override the default props for for the CloudWatchLogs LogGroup.Pattern PropertiesNameTypeDescriptionuserPoolcognito.UserPoolReturns an instance of cognito.UserPool created by the constructuserPoolClientcognito.UserPoolClientReturns an instance of cognito.UserPoolClient created by the constructapiGatewayapi.RestApiReturns an instance of api.RestApi created by the constructapiGatewayCloudWatchRole?iam.RoleReturns an instance of the iam.Role created by the construct for API Gateway for CloudWatch access.apiGatewayLogGrouplogs.LogGroupReturns an instance of the LogGroup created by the construct for API Gateway access logging to CloudWatch.apiGatewayAuthorizerapi.CfnAuthorizerReturns an instance of the api.CfnAuthorizer created by the construct for API Gateway methods authorization.lambdaFunctionlambda.FunctionReturns an instance of lambda.Function created by the constructDefault settingsOut of the box implementation of the Construct without any override will set the following defaults:Amazon CognitoSet password policy for User PoolsEnforce the advanced security mode for User PoolsAmazon API GatewayDeploy an edge-optimized API endpointEnable CloudWatch logging for API GatewayConfigure least privilege access IAM role for API GatewaySet the default authorizationType for all API methods to Cognito User PoolEnable X-Ray TracingAWS Lambda FunctionConfigure limited privilege access IAM role for Lambda functionEnable reusing connections with Keep-Alive for NodeJs Lambda functionEnable X-Ray TracingSet Environment VariablesAWS_NODEJS_CONNECTION_REUSE_ENABLED (for Node 10.x and higher functions)Architecture© Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.