Protecting APIs Deployed Behind the AWS API Gateway

In the Quickstart tab, select Deploy Authorizer.

Sign into your AWS account.

Once you sign in, you are taken to the AWS Cloud Formation where you can create your stack according to the template provided by SecureAuth.

Define the authorizer stack.

1. Provide a name for your stack in the Stack name field.

2. In the Base configuration panel, define the required settings for the authorizer.

   The client identifier, client secret, and issuer URL are you authorizer client application credentials. In the SecureAuth platform, when you create an authorizer, a client application is created for your authorizer in the System workspace of your tenant. This client application is used to authenticate the authorizer's requests to the SecureAuth platform to, for example, fetch authorization policies.

   As you can see, the client identifier, issuer URL, and the authorizer version settings are already provided.

   Provide the client secret for your authorizer. You can find it in the Settings tab for the SecureAuth AWS Lambda Authorizer.

3. In the Advanced configuration and Certificate configuration tabs, define optional configuration for your authorizer.

   You can learn more about configuration and available settings for SecureAuth AWS Lambda Authorizer in the Configure SecureAuth AWS Lambda Authorizer section.

   Authorizer Configuration{

   Configuration settings that are a part of the template you use to create your stack are treated as PRODUCTION READY configuration. All additional configuration is treated as configuration for development purposes.

   When redeploying an authorizer, only the configuration from the template (stack configuration) is persisted. Any other configuration (using environment variables) is not persisted and has to be readded.

4. In the Capabilities panel, ackowledge that AWS CloudFormation might create IAM resources.

5. Select Create Stack.

   Creating a stack may take a moment. After you select Create Stack, you are taken to the CloudFormation Events view. There, you can see that the Stack has the CREATE_IN_PROGRESS.

   Once the stack is created, its status changes to CREATE_COMPLETE. You can confirm it in the Events view or, for example, you can go to Lambda > Applications where you are able to select your Authorizer and verify its configuration.

   If you wish, you may review your authorizer permissions by going to Lambda and selecting the authorizer you deployed. Then, go to Configuration tab and select Permissions from the menu.

   Cloudwatch Logs

   You can review CloudWatch logs for the authorizer at any moment after the stack deployment. You can do it by going to CloudWatch > Logs > Log groups and searching for the authorizer's identifier (you can get if from your Lambda Function overview).

   At this point, in the logs you will see that when your authorizer is started, it throws the failed to get gateway configuration error. Do not worry, it happens because your authorizer is not yet connected to any gateway.

6. In AWS API Gateway, redeploy your APIs.

   SecureAuth AWS Lambda Authorizer is added to your gateway. To confirm it:

   • Check the Function Overview for your Lambda Function (authorizer)

     You can see that the Gateway can now trigger the authorizer.

   • In AWS Gateway, check the Authorizers view for the APIs that you redeployed.

     You can see that the gateway has an authorizer added and it can delegate access control to your Lambda Function.

   If you enabled the Create and bind services automatically option when creating the AWS Lambda Authorizer in SecureAuth, your APIs are discovered and bound to your Authorizer. Confirm it by going to Enforcement > APIs in the workspace you had added the authorizer.

   If you did not enable the Create and bind services automatically option, your APIs are discovered but they are not automatically binded to any service.

Create a policy or reuse one of the already existing ones.

To learn more, see authorization policies documentation.

Select Enforcement > APIs from the left sidebar and go to the AUTHORIZATION tab.

Select a service protected by the SecureAuth AWS Lambda Authorizer and any API with authorization status Unrestricted.

In the Edit API popup window, select Policy from the dropdown list and click Update to proceed.

In AWS API Gateway, redeploy your APIs.

Go to your Amazon API Gateway dashboard and select the API secured with SecureAuth.

From the left sidebar, go to Stages and select the stage with your API.

Copy the invoke URL of the stage.

Execute the curl command in the terminal of your computer.

curl {invoke_url}/{api}                  

The {invoke_url} variable stands for the invoke URL that you copied from your APIs stage. The api variable points to the particular API you wish to request. For example, it may be pets if you had deployed the example service from AWS API Gateway.

You receive an HTTP 200 status code.

In SecureAuth, assign the Block API policy to the API of your choice.

Redeploy your API.

Execute the curl command in the terminal of your computer.

curl {invoke_url}/{api}                  

The {api} should point to the API you had protected with the Block API policy in the previous step.

You have an AWS console account with all required permissions to manage your Lambda Functions and API gateways.

APIs are deployed behind your AWS API Gateway.

You had set up access control enforcement for your APIs deployed behind the AWS API Gateway and use SecureAuth's Lambda Authorizer as described in the above sections.

To start updating your authorizer, perform steps 1-4 from the Configure SecureAuth AWS Lambda Authorizer section.

When setting the Stack details, set the Inject context field to true.

Prepare a Lambda Function that will serve as your Lambda Proxy integration.

Your custom Lambda Function should follow the guidelines present in the AWS Setting up Lambda custom integrations article. Adjust the event handler according to your needs. For example, you can provide your request responses and status codes.

Below, you can find a simple example of a lambda_handler that responds with the HTTP 200 status code and dumps a JSON response body. The body includes the base64-encoded authentication context that the Lambda Function receives from the Lambda Authorizer.

import json

def lambda_handler(event, context):
print(json.dumps(event))
return {'statusCode': 200, 'body': json.dumps(event)}
                  

Go to your AWS API Gateway > Resources, choose a particular method and add an Integration Request.

1. Set the integration type to Lambda Function.

2. Enable the Use Lambda Proxy integration checkbox.

   Lambda Proxy Integration

   The request to your APIs will be proxied to your Lambda Function that you created in the second step with the request details available in the event object of your handler function.

3. Provide the identifier of your custom Lambda Function that you created in the second step as the value for the Lambda Function input field.

Redeploy your APIs in AWS.

Make a request to the API that you protect with the SecureAuth AWS Lambda Authorizer and that you had applied with a custom Lambda Function integration.