Secure Serverless API with JWT Authentication using Lambda Authorizers

Repository Purpose

This repository provides a set of reusable Lambda Authorizer implementations for securing APIs on AWS using API Gateway, JWTs, and optional third-party identity providers like Google. It serves as a knowledge base and a proof of concept (PoC) starter kit for developers building stateless, serverless APIs with access control.

The repository includes the following key Lambda Authorizer implementations:

• jwt_auth_token.py – Validates custom JWTs using a shared secret (HS256).
• jwt_auth_token_websocket.py – Adapts JWT validation for WebSocket connections.
• jwt_auth_token_google.py – Validates Google-issued ID tokens (OAuth 2.0).

Supporting functions:

• restricted_access_lambda.py – A basic protected endpoint returning a timestamp.
• jwt_create_token.py – Authenticates users and generates signed JWTs.
• create_password.py – A utility script to hash plaintext passwords for DynamoDB.

Additionally, a Dockerfile is included for generating Lambda Layers with external dependencies.

---

Authorizer Types Comparison

Feature	jwt_auth_token.py	jwt_auth_token_websocket.py	jwt_auth_token_google.py
Use case	REST API with custom JWTs	WebSocket $connect authorizer	REST API using Google Identity Services
Token format	HS256-signed JWT	HS256-signed JWT	Google ID token (OAuth 2.0)
Token validation method	jwt.decode()	jwt.decode()	google.oauth2.id_token.verify_oauth2_token()
Token source	authorizationToken	headers['Authorization']	authorizationToken
Env variable(s)	JWT_SECRET	JWT_SECRET	GOOGLE_CLIENT_ID
Resource ARN filtering	Yes	No (always allows $connect)	Yes, using fnmatch pattern matching
Context values	user_id, authorized	userId	email, authorized

---

Setup Instructions

1. Create DynamoDB Table

• Name: user_credentials
• Primary key: user_id (String)

2. Create and Deploy Lambda Functions

restricted_access_lambda.py

• Returns HTTP 200 with current timestamp.

jwt_create_token.py

• Environment variables:

  • USER_CREDENTIALS_TABLE_NAME = user_credentials
  • JWT_SECRET = <your_secret>

• Permissions:

  • DynamoDB read access
  • CloudWatch logging

jwt_auth_token.py

• Environment variable:

  • JWT_SECRET = <your_secret>

jwt_auth_token_google.py

• Environment variable:

  • GOOGLE_CLIENT_ID = <your_client_id>

jwt_auth_token_websocket.py

• Environment variable:

  • JWT_SECRET = <your_secret>

create_password.py

• Local utility for generating bcrypt hashes

---

API Gateway Configuration

REST API (DemoAPI)

• /auth (POST): jwt_create_token
• /api (GET): restricted_access_lambda (protected by one of the Lambda Authorizers)

Lambda Authorizer Setup

• Name: e.g., protect_lambda
• Token source: Authorization header
• Attached to /api endpoint

WebSocket API (if used)

• Set $connect route to use jwt_auth_token_websocket as an authorizer

---

Build Lambda Layer (Optional for Dependencies)

This repository includes two separate requirements files depending on the type of Lambda Authorizer you're using:

• requirements_basic_auth.txt: Use for jwt_auth_token.py, jwt_auth_token_websocket.py, and jwt_create_token.py
• requirements_google_auth.txt: Use for jwt_auth_token_google.py

Before Building the Layer

To avoid editing the Dockerfile, rename the desired requirements file to requirements.txt:

cp requirements_basic_auth.txt requirements.txt  # For basic/custom JWT
# OR
cp requirements_google_auth.txt requirements.txt  # For Google ID token validation

Step 1: Verify Docker Installation

docker --version
docker ps

Step 2: Build the Docker Image

docker build -t lambda_layer .

Step 3: Run Container and Export Zip

docker run --name my_lambda_layer_container lambda_layer
docker cp my_lambda_layer_container:/home/python_dependencies.zip .

Step 4: Cleanup

docker stop my_lambda_layer_container
docker rm my_lambda_layer_container
docker rmi lambda_layer

Upload python_dependencies.zip to Lambda as a layer.

---

Testing

Token Creation

curl -X POST <invoke_url>/auth -d '{"user_id": "testuser", "password": "password123"}'

Access Protected Endpoint (REST)

curl -H "Authorization: Bearer <jwt_token>" <invoke_url>/api

---

Security Best Practices

• Use strong secrets (JWT_SECRET, GOOGLE_CLIENT_ID) and store them securely
• Restrict IAM permissions to minimum required
• Avoid wildcard ARNs in production unless scoped appropriately
• Always validate JWT claims such as aud, exp, iss, and email_verified

---

References

• AWS API Gateway Lambda Authorizer Docs
• JWT.io Overview
• Google Identity Services Guide
• Using Docker for AWS Lambda Layers