Lambda Function is exposed to public
There is a issue that the Lambda Function is exposed to public. An HTTP Api gateway is attached to the lambda. This API Gateway routes are protected with Cognito Authorizers (JWT). Still, the Gateway route is exposed to public through gateway invoke URL. No option for adding Resource policy to HTTP API Gateway Routes.
Is the following the ideal solution i should go [https://aws.amazon.com/blogs/networking-and-content-delivery/restricting-access-http-api-gateway-lambda-authorizer/ ] Or is there any better ways
- Language
- English
asked 2 years ago514 views
- Newest
- Most votes
- Most comments
If your API's routes are protected with Cognito authorizer, you are OK.
The Lambda function's resource policy allows the specific API to invoke it, and the API ensures that only users that authenticated with Cognito are allowed in.
Hello,
Is your API Gateway used by a mobile or a frontend app? Or, is it used by other services in a sort of machine-to-machine (service-to-service) communication?
For the latter, you could turn to a Private API Gateway endpoint. However, private API Gateway:
- available for REST APIs only (not for HTTP API)
- require a bit more networking setup (VPC Endpoint Interface) with a bit of extra costs
If you are sure about your API clients' IP addresses, you can also use API Gateway resource policy and block access for untrusted IP addresses.
Regards, Yev
answered 2 years ago
Relevant content
asked 2 years ago
I got a risk alert from orca that - Lambda Function is exposed to public, and i trying to fix that, so you are suggesting that it is fine even the lambda is exposed to public because only authorized ones can route through api gateway right, so can skip this alert, or is there a better way to handle that, like having a mechanism to filter the specific ips or any other