API Gateway Lambda Token Authorizer | Serverless Security

In this video, I show you how to set up a lambda token authorizer for your API Gateway using AWS SAM.

★★ README / OPEN ME ★★

☆☆ ABOUT THIS VIDEO ☆☆
This is the second video in this series of API Gateway security mechanisms. In this video, I will show you how to set up a lambda token authorizer for API Gateway using AWS SAM. All as infrastructure as code.

☆☆ FOLLOW ME ONLINE ☆☆

📷Instagram: foobar_codes

☆☆ ABOUT FOOBAR ☆☆
In this channel, you can find mostly coding tutorials related to cloud and serverless.
In addition, I like also talking about architecture, software design, motivation, and leadership.
There is a new video every Tuesday, so stay tuned :)
.....

[LUISGONZALEZ-girw]

Excelente video Marcia. Muchas gracias por compartir tus conocimientos 👍

[RalphShillington]

Very clean presentation of just what's needed to understand custom authorizers.

[dipankarsaha]

Exact to the point explanation for custom token based authorization ....Thank You!!!👍👍

[saurabht]

Very concise and to the point. Thanks for being so efficient.

[martinds]

I love it. Straight to the point. Thank you!

[pauloqueiroz]

Great video! I didn't expect the "tchau tchau" portuguese in the end! 😂😂

[miguelrubio]

I am creating an app that retrieves some data from DynamoDB inputted by the user through the web hosted UI every time the user login. I have completed the authorization part but I can’t figure out how to create the lambda function in AWS for the authentication part. I keep getting the message “unauthorized “. Any advice?

[ankitagarwal]

I want to attach 3 api gateway authorizer trigger to jwt authorizer lambda function through cloudformation. The problem is that 3 api gateways are created from 3 different stacks. How can I do that?

[ajaytiwari]

Can you please tell me that since api gateway have restrictions of 30 secs . So will Authorize lambda will include in 30 sec or it will exclude form 30 sec and will start time when the actual lambda triggered. Can you please explain us about that

[nickarthur_night]

just what the doctor ordered! you're great!

[mezeee]

Gracias por el video. Estoy laburando en Golang, pero creo que lo que me falta en mi lambda authorizer es el tema de la policy. Tecnicamente la lambda que resuelve el auth tiene que retornarlo si o si no?
Creo que me falta esto, porque cuando realizo pruebas me indica que el API GW no tiene permisos para asumir el role de ejecución.

[lawais]

is this supported in Sam Local Start-Api?

[mylifemyrules]

how to use multiple authoriser for same api in apigateway? Now I m using cognito as authoriser. I want to be able to invoke without cognito also.

[lennymanyeki]

Quick question. If i have a lambda function with multiple HTTP verbs. How would i go about that when creating the Lambda token authorizer. I have tried but it keeps giving me user not authorized errors

[davethorn]

Thanks for taking time to do this video. I am using fusionAuth and terraform. Could anyone tell me where to see an example of doing this in terraform ? is it as simple as setting the aws_apigatewayv2_authorizer jwt_configuration .issuer to the fusionAuth (I am using fusionAuth) url ?

[kitulinokitulino]

Thank you very much. Very instructive video :-) I have one question : If I have 2 functions one dealing with GET and one with POST for example, if I want that only the one with POST to be protected with token, how can I adapt yaml template ? Shall I declare 2 API ? Or can do it with one API resource only ? If yes how ?
Thank you :)

[yw]

Thanks your for sharing!
Can I authenticate token (JWT) with user in DynamoDB? And I want to protect resource like user with id 123 can not process resource of other users, then I will handle logic in generate policy?

[shivamulagala]

Quick question. How is that token authorization worked without any token(you just used authorization=true in headers). How it is authorized?

[ahmedbadawy]

one of the best videos
straight forward

[vishuk]

Can we do caching with a lambda authoriser?