https://serverless-stack.com/ logo
Join Slack
Powered by
When trying to use the `HttpUserPoolAuthorizer` fr...
# help
r
When trying to use the 
HttpUserPoolAuthorizer
from 
@aws-cdk/aws-apigatewayv2-authorizers
to create a Cognito jwt authoriser I get the following error: Is this a version incompatibility issue between SST and Cognito?
Copy code
Error: construct does not have an associated node. All constructs must extend the "Construct" base class
    at Function.of (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/core/node_modules/constructs/src/construct.ts:30:13)
    at new Node (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/core/node_modules/constructs/src/construct.ts:75:12)
    at new ConstructNode (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/core/lib/construct-compat.ts:291:24)
    at Object.createNode (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/core/lib/construct-compat.ts:78:11)
    at new Construct (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/core/node_modules/constructs/src/construct.ts:575:26)
    at new Construct (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/core/lib/construct-compat.ts:75:5)
    at new Resource (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/core/lib/resource.ts:151:5)
    at new HttpAuthorizer (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/aws-apigatewayv2/lib/http/authorizer.ts:159:5)
    at HttpUserPoolAuthorizer.bind (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/aws-apigatewayv2-authorizers/lib/http/user-pool.ts:59:25)
    at new HttpRoute (/home/robert/code/HeyDaily/heydaily-serverless/node_modules/@aws-cdk/aws-apigatewayv2-alpha/lib/http/route.ts:196:45)
On a related note, what are the advantages of using IAM auth over JWTs? It seems way easier to use JWTs e.g. when making cURL requests or in Postman
f
Hey @Robert Chandler, which version of SST r u on? And can u share how u r creating the authorizer?
r
Copy code
const authorizer = new HttpUserPoolAuthorizer("InfluencerApiAuthorizer", props.auth.cognitoUserPool, {
            userPoolClients: [props.auth.cognitoUserPoolClient],
        });
Copy code
robert@robert-XPS-15-9560:~/code/HeyDaily/heydaily-serverless$ sst --version
SST: 0.69.2
CDK: 2.15.0
f
And can i see the version of 
@aws-cdk/aws-apigatewayv2-authorizers
in ur package.json?
r
"@aws-cdk/aws-apigatewayv2-authorizers": "^1.152.0",
f
can u pin it to 
2.15.0-alpha.0
and then give it a try?
r
Will do
npm ERR! notarget No matching version found for @aws-cdk/aws-apigatewayv2-authorizers@2.15.0-alpha.0.
f
"@aws-cdk/aws-apigatewayv2-authorizers-alpha": "2.15.0-alpha.0"
try this
r
Changing to 
import { HttpUserPoolAuthorizer } from "@aws-cdk/aws-apigatewayv2-authorizers-alpha";
looks promising
f
yup yup
r
Ok, I think this will work 😎 Thanks Frank ❤️
f
And as for IAM vs JWT auth, go with JWT first. And then if you want ur frontend users to interact with other AWS resources (part from APIs), you can look into ways to issue them IAM credentials.
And if ur frontend users have IAM credentials, u could use IAM auth for the API.
r
Interesting, currently we interact with S3 on the frontend but do this by generating a pre-singed URL on the backend
f
Yeah, that works. An alternative setup would be allowing frontend users upload directly to S3, in which case, they’d need IAM credentails with S3 permissions
t
personally prefer the jwt approach as well, you do have to do the "extra step" of setting up presigned urls but to me that actually is simpler
Open in Slack
PreviousNext
Powered by