Skip to main content

CDK Constructs for AWS Cognito to AWS API Gateway to AWS Lambda integration

Project description

aws-cognito-apigateway-lambda module

---

Stability: Experimental

All classes are under active development and subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.


Reference Documentation: https://docs.aws.amazon.com/solutions/latest/constructs/
Language Package
Python Logo Python aws_solutions_constructs.aws_cognito_apigateway_lambda
Typescript Logo Typescript @aws-solutions-constructs/aws-cognito-apigateway-lambda
Java Logo Java software.amazon.awsconstructs.services.cognitoapigatewaylambda

This AWS Solutions Construct implements an Amazon Cognito securing an Amazon API Gateway Lambda backed REST APIs pattern.

Here is a minimal deployable pattern definition in Typescript:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
from aws_solutions_constructs.aws_cognito_apigateway_lambda import CognitoToApiGatewayToLambda

CognitoToApiGatewayToLambda(self, "test-cognito-apigateway-lambda",
    lambda_function_props=FunctionProps(
        code=lambda_.Code.from_asset(f"{__dirname}/lambda"),
        runtime=lambda_.Runtime.NODEJS_12_X,
        handler="index.handler"
    )
)

If you are defining resources and methods on your API (e.g. proxy = false), then you must call addAuthorizers() after the API is fully defined to ensure every method is protected. Here is an example in Typescript:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
from aws_solutions_constructs.aws_cognito_apigateway_lambda import CognitoToApiGatewayToLambda

construct = CognitoToApiGatewayToLambda(self, "test-cognito-apigateway-lambda",
    lambda_function_props=FunctionProps(
        code=lambda_.Code.from_asset(f"{__dirname}/lambda"),
        runtime=lambda_.Runtime.NODEJS_12_X,
        handler="index.handler"
    ),
    api_gateway_props={
        "proxy": False
    }
)

resource = construct.api_gateway.root.add_resource("foobar")
resource.add_method("POST")

# Mandatory to call this method to Apply the Cognito Authorizers on all API methods
construct.add_authorizers()

Initializer

new CognitoToApiGatewayToLambda(scope: Construct, id: string, props: CognitoToApiGatewayToLambdaProps);

Parameters

Pattern Construct Props

Name Type Description
existingLambdaObj? lambda.Function Existing instance of Lambda Function object, if this is set then the lambdaFunctionProps is ignored.
lambdaFunctionProps? lambda.FunctionProps User provided props to override the default props for the Lambda function.
apiGatewayProps? api.LambdaRestApiProps Optional user provided props to override the default props for API Gateway
cognitoUserPoolProps? cognito.UserPoolProps Optional user provided props to override the default props for Cognito User Pool
cognitoUserPoolClientProps? cognito.UserPoolClientProps Optional user provided props to override the default props for Cognito User Pool Client

Pattern Properties

Name Type Description
userPool cognito.UserPool Returns an instance of cognito.UserPool created by the construct
userPoolClient cognito.UserPoolClient Returns an instance of cognito.UserPoolClient created by the construct
apiGateway api.RestApi Returns an instance of api.RestApi created by the construct
apiGatewayCloudWatchRole iam.Role Returns an instance of the iam.Role created by the construct for API Gateway for CloudWatch access.
apiGatewayLogGroup logs.LogGroup Returns an instance of the LogGroup created by the construct for API Gateway access logging to CloudWatch.
apiGatewayAuthorizer api.CfnAuthorizer Returns an instance of the api.CfnAuthorizer created by the construct for API Gateway methods authorization.
lambdaFunction lambda.Function Returns an instance of lambda.Function created by the construct

Default settings

Out of the box implementation of the Construct without any override will set the following defaults:

Amazon Cognito

  • Set password policy for User Pools
  • Enforce the advanced security mode for User Pools

Amazon API Gateway

  • Deploy an edge-optimized API endpoint
  • Enable CloudWatch logging for API Gateway
  • Configure least privilege access IAM role for API Gateway
  • Set the default authorizationType for all API methods to Cognito User Pool
  • Enable X-Ray Tracing

AWS Lambda Function

  • Configure limited privilege access IAM role for Lambda function
  • Enable reusing connections with Keep-Alive for NodeJs Lambda function
  • Enable X-Ray Tracing

Architecture

Architecture Diagram


© Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Project details


Release history Release notifications | RSS feed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

Built Distribution

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page