Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Single Custom API Gateway authorizer for both employees and services.

1

Hi, I have a use case where I want to expose Rest API endpoint both for employees as well as to a service.

#1. Employee should be able to invoke this endpoint from browser. We need to authenticate them using Midway.

#2. Some service should be able to invoke this endpoint internally.

The #1 can we achieved by integrating Cognito + Userpool authorizer to API Gateway. And #2 can be achieved using IAM.

Is it possible to have some kind of custom authorizer which can handle both the use-cases?

Topics
MicroservicesFront-End Web & MobileComputeNetworking & Content DeliverySecurity, Identity, & Compliance
Tags
Amazon API GatewayMicroservicesAmazon CognitoAWS Lambda
Language
English

asked 2 years ago524 views

1 Answer
1

You can definitely write a custom authorizer to do what you want; but doing so takes away the ease with which you can link Cognito and API Gateway now. The custom authorizer will have to determine whether the caller is a user or service and authenticate the access appropriately. So it's more work for you to write that code.

Would you consider having a separate API for service integration? That might be easier especially if the API is already deployed through automation - deploy it twice; use the same configuration except for the authorizer.

EXPERT

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content