awslabs / awslabs/aws-solutions-constructs
OpenApiGatewayToLambda - Dynamically inclue ARN for Cognito Pool Authorizer
- Dominant language
- TypeScript
- Stars
- 1.4k
- Forks
- 268
- Avg merge
- 5h 18m
- Merged PRs (30d)
- 5
Description
Is there a way to dynamically include the ARN in the providerArns when using the "x-amazon-apigateway-authorizer" in the open API document?
I've created the cognito pool/scopes/domain/client etc. in CDK, but I just realised nothing is showing in the UI for API Gateway, so I don't think it is linked up to the gateway. I used an example that seemed to setup cognito pool as a standard oauth provider rather than anything AWS specific.
I saw the example [here](https://github.com/awslabs/aws-solutions-constructs/blob/main/source/patterns/%40aws-solutions-constructs/aws-openapigateway-lambda/test/openapi/apiDefinition-withCognitoAuth.yaml) that showed the cognito pool in the provider ARN list, but it required a hard-coded ARN.
It's very possible I'm just doing something wrong in my current code which is causing it to not get attached.
Switching to the example in the repo does seem like a much more straightforward option, if it's possible to dynamically add that ARN value somehow as I'd be deploying to multiple accounts/environments so they'd each have a different ARN for the cognito pool.
```
components:
securitySchemes:
UserPool:
type: oauth2
description: Using Cognito oAuth
x-amazon-apigateway-authorizer:
type: jwt
identitySource: "$request.header.Authorization" # This indicates that the JWT token is passed in the Authorization header of the request
jwtConfiguration:
audience:
- "XXXXXXXXXXXXXXXXXXXXXXXXXX" # This is where you specify the client ID of your Cognito user pool app client
issuer: https://cognito-idp.XX-XXXXXXX-X.amazonaws.com/XX-XXXXXXX-X_xxxxxxxx
```
Thanks!
Contributor guide
Research direction
Start with source/patterns/@aws-solutions-constructs/aws-openapigateway-lambda/test/openapi/apiDefinition-withCognitoAuth.yaml and compare its Cognito authorizer configuration with the construct's documented usage. Determine how the Cognito pool ARN and environment-specific values should be supplied, then verify that the generated API Gateway authorizer is linked correctly when deployed to multiple accounts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, openapi, typescript
- Domain
- api, authentication, backend, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100