lambda_api_gw_authorizer.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: 'AWS::Serverless-2016-10-31'

Resources:
  LambdaFuncRoleForAuthorizer:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: "lambda.amazonaws.com"
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: "LambdaExecutionPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  - "logs:CreateLogGroup"
                  - "logs:CreateLogStream"
                  - "logs:PutLogEvents"
                Resource: "arn:aws:logs:*:*:*"
              - Effect: Allow
                Action:
                  - "lambda:InvokeFunction"
                Resource: !GetAtt MyLambdaFunction.Arn

  MyLambdaFunction:
    Type: 'AWS::Serverless::Function'
    Properties:
      Runtime: python3.10
      Handler: index.handler
      Events:
        getEndpoint:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /
            Method: POST
      InlineCode: |
        def handler(event, context):
            return {'body': 'Hello World!', 'statusCode': 200}
  
  MyApi:
    Type: 'AWS::Serverless::Api'
    Properties:
      Name: !Join [ "", [ "test-api-gw-","dev"] ]
      StageName: 'prod'
      # DefinitionBody:
      #   swagger: '2.0'
      #   info:
      #     title: 'My API'
      #     version: '1.0'
      #   paths:
      #     /hello:
      #       get:
      #         responses:
      #           '200':
      #             description: 'OK'
      #         x-amazon-apigateway-integration:
      #           httpMethod: GET
      #           type: AWS_PROXY
      #           uri:
      #             Fn::Sub: 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyLambdaFunction.Arn}/invocations'
      Auth:
        DefaultAuthorizer: APIGWAuthorizer
        AddDefaultAuthorizerToCorsPreflight: false
        Authorizers:
          APIGWAuthorizer:
            FunctionArn: !GetAtt AuthorizerForAPIGW.Arn
            Identity:
              ReAuthorizeEvery: 0
        ResourcePolicy:
          CustomStatements: 
            - Effect: "Allow"
              Principal: "*"
              Action: "execute-api:Invoke"
              Resource: "execute-api:/*"
              Condition:
                StringEquals:
                  "aws:userid": !Sub "arn:aws:sts::${AWS::AccountId}:assumed-role/${LambdaFuncRoleForAuthorizer.Arn}/*"
      MethodSettings:
        - ResourcePath: '/*'
          HttpMethod: '*'
          MetricsEnabled: true
          DataTraceEnabled: true
      Tags:
        what: hello
  
  ApiGatewayLogGroup:
    Type: 'AWS::Logs::LogGroup'
    Properties:
      LogGroupName: !Join [ "", [ "test-api-gw-log-grp-",!Ref MyApi,"/","dev"] ]
      RetentionInDays: 30
      Tags:
        - Key: 'Environment'
          Value: 'Production'
        - Key: 'Owner'
          Value: 'MyTeam'

  AuthorizerForAPIGW:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: "authorizer-for-api-gw"
      Role: !GetAtt LambdaFuncRoleForAuthorizer.Arn
      Handler: src/index.handler
      Runtime: nodejs16.x
      MemorySize: 320
      Timeout: 20
      InlineCode: |
        exports.handler =  function(event, context, callback) {
          var token = event.authorizationToken;
          switch (token) {
            case 'allow':
              callback(null, generatePolicy('user', 'Allow', event.methodArn));
              break;
            case 'deny':
              callback(null, generatePolicy('user', 'Deny', event.methodArn));
              break;
            case 'unauthorized':
              callback("Unauthorized");   // Return a 401 Unauthorized response
              break;
            default:
              callback("Error: Invalid token"); // Return a 500 Invalid token response
          }
        };
        var generatePolicy = function(principalId, effect, resource) {
          var authResponse = {};  
          authResponse.principalId = principalId;
          if (effect && resource) {
            var policyDocument = {};
            policyDocument.Version = '2012-10-17'; 
            policyDocument.Statement = [];
            var statementOne = {};
            statementOne.Action = 'execute-api:Invoke'; 
            statementOne.Effect = effect;
            statementOne.Resource = resource;
            policyDocument.Statement[0] = statementOne;
            authResponse.policyDocument = policyDocument;
            console.log("statement",statementOne);
            console.log("policyDocument",policyDocument);
          }
          authResponse.context = {
            "stringKey": "stringval",
            "numberKey": 123,
            "booleanKey": true
          };
          return authResponse;
        }