Is lambda authorizer caching working for you guys?...
# ssta
Adrián Mouly
08/19/2021, 7:45 AMIs lambda authorizer caching working for you guys?
For me, it’s caching the responses always. I’m sending different bearer JWT tokens, and is caching the response and returning always the same, even for different tokens.
g
Gabriel Bleu
08/19/2021, 7:52 AMThe identity source is set to the token ?
a
Adrián Mouly
08/19/2021, 8:22 AMYeah.
f
Frank
08/19/2021, 1:15 PM
Hey @Adrián Mouly, I added 2 examples here with Lambda authorizer, one with simple response and one with IAM policy response. Caching seems fine when I was testing them out. Default to 5min.
Frank
08/19/2021, 1:16 PM
Frank
08/19/2021, 1:18 PM
They aren’t using JWT, but rather BASIC auth. The idea should be similar, the identity source in this case defaults to
['$request.header.Authorization']a
Adrián Mouly
08/19/2021, 1:35 PMOk thank you @Frank.
Adrián Mouly
08/19/2021, 1:36 PM@Frank would be possible to make an example with IAM_AUTH at some point?
Adrián Mouly
08/19/2021, 1:37 PMNot related to the caching issue, but in other API I’m trying to use IAM_AUTH but always getting 503.
Adrián Mouly
08/19/2021, 1:38 PMAnd not sure how is supposed to send the IAM auth headers, I’m using postman to test it.
f
Frank
08/19/2021, 2:19 PM
There are 5 examples in the that are AWS_IAM authorized. Each one comes with a tutorial as well - https://github.com/serverless-stack/serverless-stack/tree/master/examples
Frank
08/19/2021, 2:19 PM
Check them out!
a
Adrián Mouly
08/19/2021, 2:23 PMBut those use facebook/twitter.. etc.. I want to use just AWS IAM.
f
Frank
08/19/2021, 2:27 PM
Yeah when using AWS_IAM, you pretty much have a Cognito Identity Pool. The authentication provider backing it can by User Pool, Facebook, etc.
a
Adrián Mouly
08/19/2021, 2:28 PMBut what if we want to use the aws-sign-v4 stuff?
Adrián Mouly
08/19/2021, 2:28 PMWhich uses AWS Auth.
f
Frank
08/19/2021, 2:29 PM
Yeah if you look at this step in the Facebook example https://serverless-stack.com/examples/how-to-add-facebook-authentication-to-a-serverless-api.html
Frank
08/19/2021, 2:30 PM
At the bottom, it’s using Insomia to test. By providing the credentials, Insomia will do the signing.
a
Adrián Mouly
08/19/2021, 2:31 PMI see, so you always going to need a provider like facebook/cognito/etc.
Adrián Mouly
08/19/2021, 2:32 PMI’m trying to use this for internal API calls, like I mentioned before. Maybe I need to create a User Pool for internal usage.
f
Frank
08/19/2021, 2:32 PM
Yup, Cognito Identity Pool just assigns temporary credentials to a user authenticated by facebook/cognito/etc, or unauthenticated
Frank
08/19/2021, 2:33 PM
Itself doesn’t do authentication
a
Adrián Mouly
08/19/2021, 2:33 PMOk, that makes sense.
Adrián Mouly
08/19/2021, 2:34 PMI was expecting that maybe it can use the AWS IAM alone.
Adrián Mouly
08/19/2021, 2:34 PMLike, this doesn’t say anything about user pools:
https://aws.amazon.com/premiumsupport/knowledge-center/iam-authentication-api-gateway/
f
Frank
08/19/2021, 2:38 PM
Yeah, this article doesn’t even mention Cognito Identity Pool. When using AWS_IAM authorizaiton. It allows anyone with IAM credentials to access the Api. For example an IAM user, an IAM role, or a Facebook/Cognito/etc user who received temporary credentials from Identity Pool.
a
Adrián Mouly
08/19/2021, 2:39 PMYes, that’s the thing… I want to use an IAM User.
Adrián Mouly
08/19/2021, 2:39 PMNot a Cognito/Facebook/etc User.
f
Frank
08/19/2021, 2:41 PM
Yeah, if you look at the Insomia screenshot in the facebook example, you just need to put in the IAM User’s credentials
a
Adrián Mouly
08/19/2021, 2:42 PMYeah, I’m doing that, but can’t make it work 😞
Adrián Mouly
08/19/2021, 2:42 PMAlways getting 503.
f
Frank
08/19/2021, 2:42 PM
Does the IAM User have the permission to execute the API?
a
Adrián Mouly
08/19/2021, 2:43 PMYeah, I created it from the Console, maybe the rule is not properly defined or something.
f
Frank
08/19/2021, 2:44 PM
Try AdministratorAccess quickly as a test?
a
Adrián Mouly
08/19/2021, 2:44 PMThat’s a IAM rule? sorry I’ve never had access to my IAM due some restrictions on my Company.
Adrián Mouly
08/19/2021, 2:44 PMBut your suggestion makes sense, to use some ADMIN access.
f
Frank
08/19/2021, 3:53 PM
I see. The permission you need is
execute-api:Invokearn:aws:execute-api:${region}:${account}:${httpApiId}/*a
Adrián Mouly
08/19/2021, 3:57 PMYESSSS.
Adrián Mouly
08/19/2021, 3:57 PMI did setup that, going to check it again.
Adrián Mouly
08/19/2021, 3:57 PMI mean, wasn’t me, due I’m not Admin in my org 😞.
Adrián Mouly
08/19/2021, 3:57 PMBut my Admin setup if like that for me.
Adrián Mouly
08/19/2021, 9:36 PMFINALLY!! GOT IT TO WORK!!
Adrián Mouly
08/19/2021, 9:37 PMMy Permission was setup incorrectly… gosh.
3 Views