Package: aws-cdk.aws-apigatewayv2-authorizers-alpha
AWS APIGatewayv2 Authorizers---This API may emit warnings. Backward compatibility is not guaranteed.All constructs moved to aws-cdk-lib/aws-apigatewayv2-authorizers.Table of ContentsIntroductionHTTP APIsDefault AuthorizationRoute AuthorizationJWT AuthorizersUser Pool AuthorizerLambda AuthorizersIAM AuthorizersWebSocket APIsLambda AuthorizerIAM AuthorizersIntroductionAPI Gateway supports multiple mechanisms for controlling and managing access to your HTTP API. They are mainly
classified into Lambda Authorizers, JWT authorizers, and standard AWS IAM roles and policies. More information is
available atControlling and managing access to an HTTP
API.HTTP APIsAccess control for HTTP APIs is managed by restricting which routes can be invoked via.Authorizers and scopes can either be applied to the API, or specifically for each route.Default AuthorizationWhen using default authorization, all routes of the API will inherit the configuration.In the example below, all routes will require themanage:booksscope present in order to invoke the integration.fromaws_cdk.aws_apigatewayv2_authorizers_alphaimportHttpJwtAuthorizerissuer="https://test.us.auth0.com"authorizer=HttpJwtAuthorizer("DefaultAuthorizer",issuer,jwt_audience=["3131231"])api=apigwv2.HttpApi(self,"HttpApi",default_authorizer=authorizer,default_authorization_scopes=["manage:books"])Route AuthorizationAuthorization can also be configured for each Route. When a route authorization is configured, it takes precedence over default authorization.The example below showcases default authorization, along with route authorization. It also shows how to remove authorization entirely for a route.GET /booksandGET /books/{id}use the default authorizer settings on the apiPOST /bookswill require the['write:books']scopePOST /loginremoves the default authorizer (unauthenticated route)fromaws_cdk.aws_apigatewayv2_authorizers_alphaimportHttpJwtAuthorizerfromaws_cdk.aws_apigatewayv2_integrations_alphaimportHttpUrlIntegrationissuer="https://test.us.auth0.com"authorizer=HttpJwtAuthorizer("DefaultAuthorizer",issuer,jwt_audience=["3131231"])api=apigwv2.HttpApi(self,"HttpApi",default_authorizer=authorizer,default_authorization_scopes=["read:books"])api.add_routes(integration=HttpUrlIntegration("BooksIntegration","https://get-books-proxy.example.com"),path="/books",methods=[apigwv2.HttpMethod.GET])api.add_routes(integration=HttpUrlIntegration("BooksIdIntegration","https://get-books-proxy.example.com"),path="/books/{id}",methods=[apigwv2.HttpMethod.GET])api.add_routes(integration=HttpUrlIntegration("BooksIntegration","https://get-books-proxy.example.com"),path="/books",methods=[apigwv2.HttpMethod.POST],authorization_scopes=["write:books"])api.add_routes(integration=HttpUrlIntegration("LoginIntegration","https://get-books-proxy.example.com"),path="/login",methods=[apigwv2.HttpMethod.POST],authorizer=apigwv2.HttpNoneAuthorizer())JWT AuthorizersJWT authorizers allow the use of JSON Web Tokens (JWTs) as part ofOpenID ConnectandOAuth 2.0frameworks to allow and restrict clients from accessing HTTP APIs.When configured, API Gateway validates the JWT submitted by the client, and allows or denies access based on its content.The location of the token is defined by theidentitySourcewhich defaults to the HTTPAuthorizationheader. However it alsosupports a number of other options.
It then decodes the JWT and validates the signature and claims, against the options defined in the authorizer and route (scopes).
For more information check theJWT Authorizer documentation.Clients that fail authorization are presented with either 2 responses:401 - Unauthorized- When the JWT validation fails403 - Forbidden- When the JWT validation is successful but the required scopes are not metfromaws_cdk.aws_apigatewayv2_authorizers_alphaimportHttpJwtAuthorizerfromaws_cdk.aws_apigatewayv2_integrations_alphaimportHttpUrlIntegrationissuer="https://test.us.auth0.com"authorizer=HttpJwtAuthorizer("BooksAuthorizer",issuer,jwt_audience=["3131231"])api=apigwv2.HttpApi(self,"HttpApi")api.add_routes(integration=HttpUrlIntegration("BooksIntegration","https://get-books-proxy.example.com"),path="/books",authorizer=authorizer)User Pool AuthorizerUser Pool Authorizer is a type of JWT Authorizer that uses a Cognito user pool and app client to control who can access your API. After a successful authorization from the app client, the generated access token will be used as the JWT.Clients accessing an API that uses a user pool authorizer must first sign in to a user pool and obtain an identity or access token.
They must then use this token in the specifiedidentitySourcefor the API call. More information is available atusing Amazon Cognito user
pools as authorizer.importaws_cdk.aws_cognitoascognitofromaws_cdk.aws_apigatewayv2_authorizers_alphaimportHttpUserPoolAuthorizerfromaws_cdk.aws_apigatewayv2_integrations_alphaimportHttpUrlIntegrationuser_pool=cognito.UserPool(self,"UserPool")authorizer=HttpUserPoolAuthorizer("BooksAuthorizer",user_pool)api=apigwv2.HttpApi(self,"HttpApi")api.add_routes(integration=HttpUrlIntegration("BooksIntegration","https://get-books-proxy.example.com"),path="/books",authorizer=authorizer)Lambda AuthorizersLambda authorizers use a Lambda function to control access to your HTTP API. When a client calls your API, API Gateway invokes your Lambda function and uses the response to determine whether the client can access your API.Lambda authorizers depending on their response, fall into either two types - Simple or IAM. You can learn about differenceshere.fromaws_cdk.aws_apigatewayv2_authorizers_alphaimportHttpLambdaAuthorizer,HttpLambdaResponseTypefromaws_cdk.aws_apigatewayv2_integrations_alphaimportHttpUrlIntegration# This function handles your auth logic# auth_handler: lambda.Functionauthorizer=HttpLambdaAuthorizer("BooksAuthorizer",auth_handler,response_types=[HttpLambdaResponseType.SIMPLE])api=apigwv2.HttpApi(self,"HttpApi")api.add_routes(integration=HttpUrlIntegration("BooksIntegration","https://get-books-proxy.example.com"),path="/books",authorizer=authorizer)IAM AuthorizersAPI Gateway supports IAM via the includedHttpIamAuthorizerand grant syntax:fromaws_cdk.aws_apigatewayv2_authorizers_alphaimportHttpIamAuthorizerfromaws_cdk.aws_apigatewayv2_integrations_alphaimportHttpUrlIntegration# principal: iam.AnyPrincipalauthorizer=HttpIamAuthorizer()http_api=apigwv2.HttpApi(self,"HttpApi",default_authorizer=authorizer)routes=http_api.add_routes(integration=HttpUrlIntegration("BooksIntegration","https://get-books-proxy.example.com"),path="/books/{book}")routes[0].grant_invoke(principal)WebSocket APIsYou can set an authorizer to your WebSocket API's$connectroute to control access to your API.Lambda AuthorizerLambda authorizers use a Lambda function to control access to your WebSocket API. When a client connects to your API, API Gateway invokes your Lambda function and uses the response to determine whether the client can access your API.fromaws_cdk.aws_apigatewayv2_authorizers_alphaimportWebSocketLambdaAuthorizerfromaws_cdk.aws_apigatewayv2_integrations_alphaimportWebSocketLambdaIntegration# This function handles your auth logic# auth_handler: lambda.Function# This function handles your WebSocket requests# handler: lambda.Functionauthorizer=WebSocketLambdaAuthorizer("Authorizer",auth_handler)integration=WebSocketLambdaIntegration("Integration",handler)apigwv2.WebSocketApi(self,"WebSocketApi",connect_route_options=apigwv2.WebSocketRouteOptions(integration=integration,authorizer=authorizer))IAM AuthorizerIAM authorizers can be used to allow identity-based access to your WebSocket API.fromaws_cdk.aws_apigatewayv2_authorizers_alphaimportWebSocketIamAuthorizerfromaws_cdk.aws_apigatewayv2_integrations_alphaimportWebSocketLambdaIntegration# This function handles your connect route# connect_handler: lambda.Functionweb_socket_api=apigwv2.WebSocketApi(self,"WebSocketApi")web_socket_api.add_route("$connect",integration=WebSocketLambdaIntegration("Integration",connect_handler),authorizer=WebSocketIamAuthorizer())# Create an IAM user (identity)user=iam.User(self,"User")web_socket_arn=Stack.of(self).format_arn(service="execute-api",resource=web_socket_api.api_id)# Grant access to the IAM useruser.attach_inline_policy(iam.Policy(self,"AllowInvoke",statements=[iam.PolicyStatement(actions=["execute-api:Invoke"],effect=iam.Effect.ALLOW,resources=[web_socket_arn])]))