3

I created an API with AWS API gateway that triggers a lambda function. Now I want to restrict access to this API. I own an OpenID connect identity provider.

I want to require people to authenticate with my OpenID identity provider before accessing the API. What is the best way to do that? Apparently, I need an authorizer for my API. I read a lot of documentation, and from what is mentioned here, it seems that this would be possible with amazon cognito. However, here I can only find a way to use cognito user pools, while I want to use a cognito identity pool.

I want the typical authentication scenario, e.g. user calls the api, is redirected to my openid id provider, logs in, and can then access my api (which delivers html so all of this will be taking place in a web browser).

Is this actually possible with cognito, or do I need to write a custom lambda authorizer? If so, is there any documentation on writing an authorizer lambda that uses openid, prefereably in .NET?

Gasp0de
  • 1,199
  • 2
  • 12
  • 30

1 Answers1

3

You are mixing Authentication and Authorization.

Federated Identity Provider to Cognito:

You can use OpenID Federated Identity provider for Authentication.

Below documentation provides on how to configure it,

https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flow.html

Once authenticated you can create a signed URL to protect your assets for the URL which you want to allow to.

Creating Signed URLs:

Below documentation providers on how to created signed URL's using C#.

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CreateSignatureInCSharp.html

Custom Authorizer:

Following commit on github shows an example implementation of C# custom authorizer.

https://github.com/awslabs/aws-apigateway-lambda-authorizer-blueprints/pull/13/commits/79d75fb7c5ee4f29fa06fd2ec28c704224cf8a7a

Hope it helps.

Kannaiyan
  • 12,554
  • 3
  • 44
  • 83