awslabs / awslabs/aws-solutions-constructs

OpenApiGatewayToLambda - Dynamically inclue ARN for Cognito Pool Authorizer

Open
#1,330 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
1.4k
Forks
268
Avg merge
5h 18m
Merged PRs (30d)
5

Description

Is there a way to dynamically include the ARN in the providerArns when using the "x-amazon-apigateway-authorizer" in the open API document?

I've created the cognito pool/scopes/domain/client etc. in CDK, but I just realised nothing is showing in the UI for API Gateway, so I don't think it is linked up to the gateway. I used an example that seemed to setup cognito pool as a standard oauth provider rather than anything AWS specific.

I saw the example [here](https://github.com/awslabs/aws-solutions-constructs/blob/main/source/patterns/%40aws-solutions-constructs/aws-openapigateway-lambda/test/openapi/apiDefinition-withCognitoAuth.yaml) that showed the cognito pool in the provider ARN list, but it required a hard-coded ARN.

It's very possible I'm just doing something wrong in my current code which is causing it to not get attached.
Switching to the example in the repo does seem like a much more straightforward option, if it's possible to dynamically add that ARN value somehow as I'd be deploying to multiple accounts/environments so they'd each have a different ARN for the cognito pool.
```
components:
securitySchemes:
UserPool:
type: oauth2
description: Using Cognito oAuth
x-amazon-apigateway-authorizer:
type: jwt
identitySource: "$request.header.Authorization" # This indicates that the JWT token is passed in the Authorization header of the request
jwtConfiguration:
audience:
- "XXXXXXXXXXXXXXXXXXXXXXXXXX" # This is where you specify the client ID of your Cognito user pool app client
issuer: https://cognito-idp.XX-XXXXXXX-X.amazonaws.com/XX-XXXXXXX-X_xxxxxxxx
```

Thanks!

Contributor guide

Open the contributing guide

Research direction

Start with source/patterns/@aws-solutions-constructs/aws-openapigateway-lambda/test/openapi/apiDefinition-withCognitoAuth.yaml and compare its Cognito authorizer configuration with the construct's documented usage. Determine how the Cognito pool ARN and environment-specific values should be supplied, then verify that the generated API Gateway authorizer is linked correctly when deployed to multiple accounts.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, openapi, typescript
Domain
api, authentication, backend, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.