I am working on lambda authorization and I learned that there are generally two options.

Either use the default authorizer on the API gateway level, which will do all the heavy lifting (validate the tokens), or write a custom authorizer, which will require me to implement all the logic including all the token validations, which I would like to avoid if possible. I don't want to write such code, I want to use something that is time proven and tested.

My question is, is it considered secure to write code in my lambda (e.g. python decorator) that will do authorization based on the data in the lambda context.authorizer.claims? assuming of course all I need is there (e.g. cognito:groups, cognito:username, etc.)

can I treat the authorizer data in the context as solid (passed the security validation)?

  • Are you asking about authentication or authorization? i.e verify if the token is authenticate, or verifying if the token has the right scope for the resource in question? – keithRozario Jan 14 at 15:27
  • @keithRozario I want to add to my API GW a Cognito User Pool authorizer that will validate the tokens that users got from the google login that is in place. then I would like to add an extra layer of authorization without having to do the token validations myself. so I figured I could write a decorator for the lambda and use the info that can be read from the context (or event if I do custom mapping of the authorization details), then act upon them (e.g. allow access to certain users). I wanted to make sure that you can count on the authorization data that you get in the lambda arguments – Roy Ca Jan 15 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.