0

on AWS API Gateway V1, when creating an Authorizer there're two options (Lambda and Cognito), and when choosing Cognito you just need to define the user pool (from a list) and the Token Source (usually the word "Authorization").

aws api gateway v1 authorizer

This way, in Cognito I can create a "App client" and with it's client_id and client_secret, the client can create an access token and call the API.

On API Gateway V2, there's no option for Cognito. They replaced by JWT option where you need to define the "Authorization" header (as API Gateway V1), the issuer URL (in this case it will be the cognito URL) and it's mandatory to define the Audience (and it's the problem for me). The audience must be a string (can be the client_id), but defining the client_id will restrict the access on the api to only the clients that were mentioned in the audience and I would like to let it open to any client that's created on the cognito pool.

On API Gateway V2 Authorizer documentation it says the gateway will verify the aud or client_id that, but cognito access tokens do not define aud attribute, so it will force the comparison with the client_id.

Is there a way to let it open as it's on API Gateway V1?

Ranieri Mazili
  • 723
  • 6
  • 21

0 Answers0