[@aws-cdk/aws-apigatewayv2] support authorizers for HTTP API

[Hugodby]

I want to be able to add an authorizer when calling the addRoutes method. Similar to what is done in the apigateway construct: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-apigateway.MethodOptions.html

Use Case

There are no straightforward to add an authorizer on HTTP API routes. This is an important security feature. Workaround are already available in blogposts: https://dev.to/martzcodes/token-authorizers-with-apigatewayv2-tricks-apigwv1-doesn-t-want-you-to-know-41jn

Proposed Solution

One solution would be to add an authorizer property on the addRoutes method:

const api = new HttpApi(this, 'Api', { .. });
const authorizer = new CfnAuthorizer(this, 'ApiAuthorizer', { ... });

api.addRoutes({
  path: '/route',
  methods: [ HttpMethod.GET ],
  integration: new LambdaProxyIntegration({ handler: Example }),
  authorizer: authorizer,
});

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[nija-at]

At the moment, we have no support for authorizers in APIGatewayV2. Marking this as a feature request for authorizers.

[lielran]

@nija-at what about Cognito authorizer?
I'm adding it to http API like this:

  private addAuthorizer(
        stack: Construct,
        httpApi: HttpApi,
        userPool: IUserPool,
        userPoolClientId: string,
    ): CfnAuthorizer {
        return new CfnAuthorizer(stack, 'CognitoAuthorizer', {
            name: 'CognitoAuthorizer',
            identitySource: ['$request.header.Authorization'],
            apiId: httpApi.httpApiId,
            authorizerType: 'JWT',
            jwtConfiguration: {
                audience: [userPoolClientId],
                issuer: `https://cognito-idp.${this.region}.amazonaws.com/${userPool.userPoolId}`,
            },
        });
    }

[iRoachie]

Working on this. Got something working, but you can't use L1 constructs as props, so I have to implement the Authorizer construct first.

[mbergkvist]

At the moment, we have no support for authorizers in APIGatewayV2. Marking this as a feature request for authorizers.

Will this include IAM authorizer?

[lielran]

Will this include IAM authorizer?
@mbergkvist
you can change that to:
authorizerType: 'AWS_IAM',

[mbergkvist]

@lielran
With

new apiGw.CfnAuthorizer(this, 'IAM Authorizer', {
      apiId: httpApi.httpApiId,
      authorizerType: 'AWS_IAM',
      identitySource: ['$request.header.Authorization'],
      name: 'IAM Authorizer'
    })

I get Invalid request input. CreateAuthorizer input is missing authorizer type. when deploying.

[rtrive]

any updates on adding authorizer to http api route?

[haandol]

below code works for me. (on cdk 1.83+)

interface RouteProps {
  api: apigwv2.IHttpApi
  authorizerType?: 'JWT' | 'AWS_IAM'
  authorizerId?: string
  routeId: string
  path: string
  method: apigwv2.HttpMethod
  handler: lambda.IFunction
}

protected addRoute(props: RouteProps) {
    if (props.authorizerType === 'JWT' && props.authorizerId === undefined) {
      throw Error('JWT authorizer requires authorizerId')
    } else if (props.authorizerType === 'AWS_IAM' && props.authorizerId !== undefined) {
      throw Error('IAM authorizer can not be configured with authorizerId')
    }

    const integration = new integrations.LambdaProxyIntegration({ handler: props.handler })
    const route = new apigwv2.HttpRoute(this, `${props.routeId}Route`, {
      httpApi: props.api,
      routeKey: apigwv2.HttpRouteKey.with(props.path, props.method),
      integration,
    })
    const routeCfn = route.node.defaultChild as apigwv2.CfnRoute
    routeCfn.authorizationType = props.authorizerType
    routeCfn.authorizerId = props.authorizerId
}

[iRoachie]

Sorry for the long pause guys! Will try to wrap up the PR this weekend.

[eikeon]

      throw Error('IAM authorizer can not be configured with authorizerId')

@haandol Does this mean this workaround doesn't work for the IAM authorizer case or that it just needs to be left undefined? (To attach an IAM authorizer with your addRoute above -- Guess I'm about to find out as I dig in)

[eikeon]

@lielran
With

new apiGw.CfnAuthorizer(this, 'IAM Authorizer', {
      apiId: httpApi.httpApiId,
      authorizerType: 'AWS_IAM',
      identitySource: ['$request.header.Authorization'],
      name: 'IAM Authorizer'
    })

I get Invalid request input. CreateAuthorizer input is missing authorizer type. when deploying.

Same. It looks like authorizerType: 'AWS_IAM' is set directly on the CfnRoute and doesn't involve a CfnAuthorizer (which doesn't list AWS_IAM as an option). @iRoachie, does the PR you're working on also deal with AWS_IAM case? Or just the two listed here: iRoachie@6db0e2d#diff-477ed79e2eac3fe55ede0a738ca3941bdc4cf84f6c60b5d28d15a028a452de56R11

[haandol]

import * as cdk from '@aws-cdk/core'
import * as lambda from '@aws-cdk/aws-lambda'
import * as apigwv2 from '@aws-cdk/aws-apigatewayv2'
import * as integrations from '@aws-cdk/aws-apigatewayv2-integrations'

interface RouteProps {
  api: apigwv2.IHttpApi
  authorizerType?: 'JWT' | 'AWS_IAM'
  authorizerId?: string
  routeId: string
  path: string
  method: apigwv2.HttpMethod
  handler: lambda.IFunction
}

export abstract class BaseApiStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props)
  }

  protected addRoute(props: RouteProps) {
    if (props.authorizerType === 'JWT' && props.authorizerId === undefined) {
      throw Error('JWT authorizer requires authorizerId')
    } else if (props.authorizerType === 'AWS_IAM' && props.authorizerId !== undefined) {
      throw Error('IAM authorizer can not be configured with authorizerId')
    }

    const integration = new integrations.LambdaProxyIntegration({ handler: props.handler })
    const route = new apigwv2.HttpRoute(this, `${props.routeId}Route`, {
      httpApi: props.api,
      routeKey: apigwv2.HttpRouteKey.with(props.path, props.method),
      integration,
    })
    const routeCfn = route.node.defaultChild as apigwv2.CfnRoute
    routeCfn.authorizationType = props.authorizerType
    routeCfn.authorizerId = props.authorizerId
  }
}

export class AdminStack extends BaseApiStack {
...

    this.addRoute({
      api: props.api,
      authorizerType: 'JWT',
      authorizerId: props.authorizerId,
      routeId: 'AdminPresignUrlClothes',
      path: '/admin/clothes/upload',
      method: apigwv2.HttpMethod.GET,
      handler: adminClothes.presignUrlClothesFunction,
    })
    this.addRoute({
      api: props.api,
      authorizerType: 'AWS_IAM',
      routeId: 'AdminUpdatelothes',
      path: '/admin/clothes',
      method: apigwv2.HttpMethod.PUT,
      handler: adminClothes.updateClothesFunction,
    })
}

here is my whole base-stack.ts.
@eikeon you can not create AWS_IAM authorizer for HTTP API because it is built-in. you can check it out on your API Gateway Console.
and in the same manner, you can not set authorizer_id to AWS_IAM typed route.

[iRoachie]

@eikeon The PR i'm working on is for JWT authorizers, but the framework should be set to add in IAM after.

As @haandol said, AWS_IAM is not an authorizer type, but simply is the REQUEST (lambda) type that returns a policy document

[eikeon]

@iRoachie and @haandol Thank you! I was just arriving there after trying to apply the work around and reading the docs; definitely getting a bit confused with the two different authorizerType's (one on the authorizer and one on the route) :| Was hoping to have some shiny L2 support to utilize but looks like I'm mostly there re: the bits to add.

[iRoachie]

Hey all, we just merged #10972 which introduces support for JWT authorizers, and a convenience cognito user pool authorizer. Just the REQUEST authorizer needed to completely close this ticket

[ADringer]

Would this allow us to add the authorizer to the $default route? Currently we have an api with just $default route defined, and using the console manually add the JWT authorizer. Would be good to be able to do this via the cdk, but can't see a way of setting it on default integration?

[iRoachie]

Yes @ADringer, you can actually add it to the API itself and it will apply to all routes https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-apigatewayv2/lib/http/api.ts#L210-L218

Edit: This isn't possible yet

[inception-cto]

Hi @iRoachie ,

Note: Using aws-cdk 1.89.0

I am trying to implement the "REQUEST" authorizer type and I cannot get to work properly.

export class CustomHttpApi extends apigatewayv2.HttpApi {
  public readonly authorizer: apigatewayv2.CfnAuthorizer;

  constructor(scope: cdk.Construct, id: string, props?: CustomHttpApiProps) {
   
    const region = props?.region || "us-east-1";
    const lambdaAuthorizerUri = `arn:aws:apigateway:${region}:lambda:path/2015-03-31/functions/${props?.lambdaAuthorizerArn}/invocations`;
   
    // ========================================================================
    // Resources: HTTP API
    // ========================================================================
    // Initialization
    super(scope, id, {
      description: props?.description,
      apiName: props?.apiName
    });

    // ========================================================================
    // Resources: HTTP Authorizer
    // ========================================================================
    this.authorizer = new apigatewayv2.CfnAuthorizer(
      this,
      "lambda-header-authorizer",
      {
        apiId: this.httpApiId,
        authorizerPayloadFormatVersion: "2.0",
        authorizerResultTtlInSeconds: cdk.Duration.seconds(120).toSeconds(),
        authorizerType: "REQUEST",
        enableSimpleResponses: true,
        authorizerUri: lambdaAuthorizerUri,
        identitySource: ["$request.header.Authorization"],
        name: "token-authorizer",
      }
    );
  }


  public addLambdaRoute(props: {
    lambdaFn: lambda.Function;
    method: HttpMethod;
    path: string;
    protected: boolean;
  }) {
    //  Step 1: Add the Lambda Handler Proxy Integration
    const integration = new LambdaProxyIntegration({
      handler: props.lambdaFn,
      payloadFormatVersion: PayloadFormatVersion.VERSION_2_0,
    });

    // Step 2: Add the Route
    const route = new apigatewayv2.HttpRoute(
      this,
      `route-lambda-${props.lambdaFn.node.id}`,
      {
        httpApi: this,
        integration: integration,
        routeKey: apigatewayv2.HttpRouteKey.with(props.path, props.methods[0]),
      }
    );

    if (props.protected) {
      route.node.children.map((child) => {
      const routeCfn = route.node.defaultChild as apigatewayv2.CfnRoute;
      routeCfn.authorizationType = this.authorizer.authorizerType;
      routeCfn.authorizerId = this.authorizer.ref;
      });
    }
}

The Authorizer is deployed properly but it is not attached to any of the APIs. Am I missing anything?

Any help is greatly appreciated.

[eikeon]

Hey all, we just merged #10972 which introduces support for JWT authorizers, and a convenience cognito user pool authorizer. Just the REQUEST authorizer needed to completely close this ticket

Anything in the works for the REQUEST authorizer bit to look at? About to revisit adding such AUTH to an API; could align with whatever might be in the works etc.

/me starts by looking at previous merge request as it was mentioned "but the framework should be set to add in IAM after."

[iRoachie]

@eikeon I made the PR, it's waiting for review #13181

[eikeon]

Thank you; that helps re: - Lambda Authorizers

I'm trying to use the built in AWS_IAM authorizationType -- which as you mentioned before isn't an authorizer and so perhaps is out of scope for this ticket?

It seems like this higher level construct could support it and have it translate to setting the right bits for the built in case.

It's looking like the following is all I need to add to the route re: AWS_IAM case:

        routes.forEach((r) => {
            const routeCfn = r.node.defaultChild as api.CfnRoute;
            routeCfn.authorizationType = "AWS_IAM";
        });

... basically this bit: https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-access-control-iam.html

And then separately add the IAM policies: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-invoke-api.html

[iRoachie]

@eikeon Oh okay I see what you mean now. Apologies if I was confused earlier. It should be relatively easy to add in another PR.

[eikeon]

@eikeon Oh okay I see what you mean now. Apologies if I was confused earlier. It should be relatively easy to add in another PR.

No worries; thank you for all the PRs! 🎉

[eikeon]

Now to figure out is there's a way to set routeCfn.authorizationType = "AWS_IAM"; but for the HttpApi's default integration

[jeznag]

I'm finding that HttpJwtAuthorizer isn't working as the defaultAuthorizer for an HTTP API.

Example:

        const authorizer = new HttpJwtAuthorizer({
            jwtAudience: ['https://okra.au.auth0.com/api/v2/'],
            jwtIssuer: 'https://okra.au.auth0.com',
            authorizerName: 'apolloAuthorizer'
        })

        const publicApi = new HttpApi(this, 'apollo-proxy-api-public', {
            defaultDomainMapping: {
                domainName: apiDomainName,
            },
            defaultIntegration: new HttpAlbIntegration({
                listener: this.props.apolloListener,
                vpcLink: this.vpcLink
            }),
            defaultAuthorizer: authorizer,
            defaultAuthorizationScopes: ['okra:internal'],
        })

        publicApi.addRoutes({
            integration: new HttpAlbIntegration({
                listener: this.props.apolloListener,
                vpcLink: this.vpcLink
            }),
            path: '/',
            authorizer,
        });

With this config, if I open the root URL (/) in my browser, I get a 401 error. But if I try any other URL, there is no authorization. Also when I deployed without the addRoutes config, there was no authorizer visible in the console but after I did addRoutes, it appears.

[iRoachie]

@eikeon I just opened #14853 for iam authorizers. Would love your feedback

[eikeon]

@iRoachie Looks good and +1 for the CDK doc linking to the relevant documentation re: some examples.

Looks like I'l be able to retire my workaround soon. Thank you!

PS: One thing I've run across -- how to apply an HttpIamAuthorizer to the default route?

[jaredtbates]

I'm running into an issue too where I'm unable to set the defaultAuthorizer to an HttpLambdaAuthorizer. Any thoughts?

[iRoachie]

@computerwizjared @jeznag I found the issue with the default authorizer. Here's the PR #14904

Thanks for reporting

[iRoachie]

@computerwizjared @jeznag the fix just landed in master. Should be available in the next release.

[eikeon]

Now to figure out is there's a way to set routeCfn.authorizationType = "AWS_IAM"; but for the HttpApi's default integration

As far as I can tell there's no way to set this for the default route case yet? (and am unsure if CloudFormation underneath supports it)

[iRoachie]

@eikeon waiting on review for #14853

The default case is handled - https://github.com/aws/aws-cdk/pull/14853/files#diff-bd5f262e88889ac7224d414c05765806bf9a20d2c12d45f6db521f2d4c05f8ebR29-R46

[nija-at]

Closing this overall issue since we have a few authorizers built.

@iRoachie - let's open separate issues per authorizer going forward.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.