(upbeat music)
- Hello, I'm Muthu, a cloud support engineer
here at the AWS office in Bangalore, India.
Sometimes customers ask me
how to authorize Amazon API gateway APIs
using custom Amazon Cognito scopes.
I tell them by making a few configurations
to Amazon API gateway and Amazon Cognito,
we can provide differentiated access
to Amazon APA gateway resources
based on Amazon Cognito custom scopes.
So today I'll be showing you how to do it.
Let's get started.
Before we begin the setup, here are a few prerequisites.
An Amazon Cognito user pool set up with a domain name
and an app clan for the hosted UI.
An Amazon API gateway with at least one resource
and one method for that resource.
Our set up is divided into two parts,
creating a resource server and custom scope
in the Amazon Cognito user pool
and allowing it for our app client.
Then creating an Amazon Cognito authorizer
for our API gateway and then associating our resource method
with an Amazon Cognito custom scope
that is verified by the APA gateway
before allowing access to the requested resource.
Once we finish our setup, we will also test it
so that we can verify that it works without any issues.
Now let me walk you through the setup.
After logging into the AWS management console,
go to the Amazon Cognito console and select your user pool.
Now to the resource servers and our app integration section.
Choose add a resource server.
Now set up the resource server.
For name, enter a friendly name for the resource server
such as a weather API .
For identifier, enter a unique identifier
for the resource server.
This could be an HTTPS endpoint
that a resource server is located.
In our case, this could be the HTTPS endpoint
for our API gateway where our API resources are located.
For scope name, enter any scope name.
For example, weather.read.
For the scope description, give a brief description
for the school.
For example, retrieve weather information.
Choose save changes.
Choose the app plan settings
under the app integration section no.
Now go to the app client settings of your hosted UI,
under allowed custom scopes checks the box
for the newly created custom scope.
Choose save changes.
Now let's see the configurations required
on the APA gateway site.
Go to your API in the APA gateway console.
Then from the main navigation page,
choose authorizers under your specific API.
Under authorizers, choose create new authorizer.
Enter an authorizer a name in the name section.
Select the Cognito option.
Choose a region under Cognito or user pool.
Select an available user pool.
You must have created a user pool for the selected region
in Amazon Cognito for it to show up in the drop down list.
For token source, enter authorization as the header name
to pass the access token that's returned by Amazon Cognito,
when I user signs in successfully.
To finish integrating the user pool with the API,
choose create.
Now, go to resources and select the method name.
Then select method request configuration.
Select the Cognito authorizer in authorization dropdown.
This action automatically
adds a new field called OAuth scopes.
Enter the full identifier for the custom scope
in the required format.
The format for a custom scope is
resourceServerIdentifier/scopeName.
Remember to save using the check mark
and then deploy the API.
We can now test the setup using Postman or cURL.
First, let's get the access token
from Cognito authorization server
using one of the OAuth 2 flows defined for the client.
For example, you could use the Cognito hosted UI
to retrieve the users tokens.
Now we have the retrieved Access Token.
We'll send this received Access Token
as the authorization header in the request to API gateway.
We'll use cURL to send the request.
Now we can see that if everything is successful
and the API gateway can validate
and verify the Access Token under required custom scope,
then you get 200 ok response.
In conclusion, using custom scopes with Amazon Cognito
and the APA gateway helps us provide differentiated levels
of access to our APA resources
in an easy and reliable manner.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(upbeat music)