By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

How to restrict data requested/returned from API Gateway/Lambda

0

Hi, I'm building an API that returns order details, which are json files stored in S3. The API will be used my multiple customers but each customer should only get access to orders created on their customer id(s).

What is the best architecture to acheive this?

Now API Gateway calls invokes a Lambda that fetches the order file from S3, without any added restrictions. Can the user somehow have an array of customer id's to check against?

I assume I also would need some kind of index on S3 if one customer would like all their orders. I cannot fetch all files from S3 and then start filtering in Lambda...

Topics
ServerlessComputeFront-End Web & MobileNetworking & Content Delivery
Tags
AWS LambdaAmazon API Gateway
Language
English
perage
asked 7 months ago167 views
1 Answer
0

If you want to use S3, I think you can store orders that belong to a customer in a folder based on customer ID. e.g.,

your-bucket/
  customer1/
    order1.json
    order2.json
  customer2/
    order3.json

and run ListBucket('your-bucket', 'customer1') to get all orders for a specific customer.

However, if possible, I would prefer store order data in NoSQL database (e.g., DynamoDB) with the customer ID set as a primary key.

profile picture
HS
answered 7 months ago
  • perage
    7 months ago

    Thanks - that's a good idea. However - how do I link the caller with the customer Id's?

  • HS
    7 months ago

    Generally, a customer ID should be able to retrieved from its authentication token. For example, if you use Congito User Pool as an user authentication service, you should decode the request sender's ID token which can be retrieved from Lambda input context.identity.cognitoIdentityId. The decoded ID token should look like this:

    {
  "sub": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "cognito:groups": ["my-test-group"],
  "email_verified": true,
  "cognito:preferred_role": "arn:aws:iam::111122223333:role/my-test-role",
  "iss": "https://cognito-idp.us-west-2.amazonaws.com/us-west-2_example",
  "cognito:username": "my-test-user",
  "middle_name": "Jane",
  "nonce": "abcdefg",
  "origin_jti": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "cognito:roles": ["arn:aws:iam::111122223333:role/my-test-role"],
  "aud": "xxxxxxxxxxxxexample",
  "event_id": "64f513be-32db-42b0-b78e-b02127b4f463",
  "token_use": "id",
  "auth_time": 1676312777,
  "exp": 1676316377,
  "iat": 1676312777,
  "jti": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
  "email": "my-test-user@example.com",
  "custom:customer_id": "customer1"
}

    Then you can decide that the authenticated request sender has the customer ID customer1.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content