(fast beat music)
- Hi, I'm Nivea,
a cloud Support Engineer here
at the AWS office in Bangalore, India.
Sometimes customers ask me how users
of an application authenticated using Amazon Cognito,
user pools can invoke an API to execute
an AWS Lambda function,
so that it executes with the Amazon Cognito group role
to which the user belongs.
I tell them,
they need to set up Amazon Cognito authorizer
for an API and then,
invoke the API using the ID token obtained
after user logs in to the application.
The role details are then passed to the proxy Lambda
in the event which can be used to assume
that role from Lambda.
So let me walk you through the process.
Here are a few prerequisites.
Amazon Cognito user pool and group have an associated role.
A client application with Amazon Cognito,
user authentication set up,
an API with a proxy resource,
which for the purpose of this video will be Lambda.
The complete setup is divided into three parts,
creating Amazon Cognito user pool authorizer for your API,
setting the authorization to the user pool authorizer
for your API resource,
modifying Lambda code to fetch role details from the event
and then assume the role.
First for creating an Amazon Cognito Custom authorizer
for the API.
As you can see,
I've already logged in to the AWS Management Console.
Now navigate to the API console page and choose your API.
Go to the authorizer session
and choose Create New Authorizer.
Choose Cognito and enter the name.
Specify the details of your Amazon Cognito user pool.
To do this,
I'll navigate to the Cognito console.
Select Manage User Pools,
and click on the user pool of my choice.
I'll now copy the pool ID from this pool.
Now let's go back to the API Gateway console,
specify the details of your Amazon Cognito user pool.
I'll select the user pool of my choice.
Under token source,
specify method.request.header.authorization.
Now choose create.
Now, let's add the authorizer for the method
of our API resource.
In the API Gateway console,
choose your API and navigate to the resources pane.
Choose Method Request.
This will open up the settings.
Choose the pencil icon next to authorization to edit it.
Choose the newly created Amazon Cognito user pool authorizer
from the list.
Now choose the tick button to update.
Now let's deploy the API.
To do this navigate to Actions,
select Deploy API,
and choose the stage to which you wish to deploy the API.
Next, we'll modify our Lambda code
to fetch the role details and assume the role.
Navigate to the Lambda console.
And then select your Lambda function which is configured
as a proxy resource.
For the purpose of this video,
my Lambda uses runtime Python.
The Lambda execution role must have only permissions
for the CloudWatch logs and for assuming the new role.
Add the following code snippet to the Lambda function.
This fetches the role from the event details
and uses the assumed role API to assume the role.
And hit Save.
And with this, a step is complete.
So now let's test it.
Go to your client application
and log in using the Amazon Cognito user.
Now let's make the call
to our API using the ID token received after logging in.
The role is passed to the Lambda
from the API gateway in the event.
For making the call, I'm gonna use the CLI.
As you can see,
I've successfully called the API using my ID token.
If you're using a custom authorizer,
be sure that you're using the user pool token
that was validated by the authorizer.
Don't assume the role
of a token without validating it first.
We can see the roll is passed
and the Lambda code fetches it,
by checking the CloudWatch logs for my function
as my code is set to log the response.
To do this,
let's go back to the AWS console
and navigate to CloudWatch.
I'll move to logs and select the appropriate log group
for my function.
I will select the last execution log stream.
As you can see,
the logs have already been populated.
Since my function is set to log the response,
we can see that the role is passed
and the Lambda code has fetched it.
The Lambda gets the role that belongs
to the Amazon Cognito groups role
to which the logged in user belongs to,
as we saw in the prerequisites
at the beginning of the video.
Based on the role, your Lambda can access AWS resources.
This setup can also be used with HTTP proxy resources.
There are other ways of achieving the use case
and this is only one of them.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(fast beat music)