AWS HTTP API Authorization using lambda

Architecture

API authorization for an HTTP API can be implemented using a lambda function. This approach is reliable and has a high success rate. In this process, a lambda function is created to verify the token, which is subsequently validated. The lambda function then returns either a boolean value or a policy document. Both the boolean value and policy document determine whether access is granted or denied for the original lambda function which we are trying to access.

Get Bezel Jacob’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

By following the below steps you can authorize your HTTP API using a lambda function

Step 1:

Firstly, create an IAM Role that grants access to API Gateway. This role will be assigned to our authorizer Lambda to ensure its proper functionality.

1. For that choose IAM service
2. On the left side panel, select Access Management, and within that, choose Roles.
3. From that click Create Role, then select AWS Service and select use case as Lambda
4. Then on the next page select the Policies which you want to give to this role
5. Then on the next page give the Role Name and then click Create Role. That’s it!

Step 2:

Then we need to create Lambda function for the authorization purpose.

1. For that we need to choose AWS Lambda service.
2. Then choose Create Function
3. Then on the next page select Author From Scratch
4. Then give a Function Name
5. Then select the Runtime ( As I am working on python I choose Python 3.9)
6. Then for the Architecture you can select x84_64
7. Then at the Permissions select use an existing role and select the API Gateway access role that we created in the earlier step (if you or not seeing your role, just reload it.
8. Then click Create Function
9. Here, I am using Python code that will return a boolean value. If you want to return a policy, you can do that as well. You can obtain the policy from the AWS documentation. Simply change the value of the “Effect” in the policy to either “Allow” or “Deny” based on the validation.

We pass token as AuthorizationToken through headers. We will take that by event[“headers”][“authorizationtoken”]. Then we will compare and return the response. You should remember that if you are passing token as Authorization then you should take the value from event like this event[“headers”][“authorization”].

Step 3:

Now our next step is to authorize our API, for that

1. Choose API Gateway service
2. From the API’s section, select your API
3. On the left side select Develop dropdown and choose Authorization
4. Now you can see your routes, select the route which you want to authorize
5. Then on the right side you can see an option Create and Attach Authorizer
6. On the next page select Authorize type as Lambda
7. Then give a name for your authorizer
8. Then choose your region and select the Lambda function that we created for our Authorization
9. Disable Authorizer Caching
10. Then on the Identity source add this $request.header.Authorization, if you are sending your token as AuthorizationToken, then you need to modify like this $request.header.AuthorizationToken
11. Then on the invoke permissions, enable Automatically grant API Gateway permission to invoke your Lambda function
12. Then click Create and Attach and that’s it!

Now it should work perfectly. To test it, you can call the API using Postman. Make sure to include the AuthorizationToken within the headers of the API request. This will trigger our Authorization Lambda function, which will validate the token and return a response. Depending on the response, if access is denied, you will receive a “Forbidden” message. Otherwise, after successful verification, you will receive the expected response from the API.