より速いAPI、より速い開発： API Gatewayカスタムオーソライザー

interface User {
id: string,
name: string,
followers: Array,
profile_pic?: string
}

import {AuthorizerRequest} from “../models/authorizer”;
import {DefaultClient} from “../repository/users/users”;
import {UsersDdb} from “../repository/users/data-clients/ddb”;
import {getMetricLogger} from “../monitoring/metrics/metricRecorder”;

const ALLOW = ‘Allow’, DENY = ‘Deny’;
const ur = new DefaultClient(new UsersDdb());

export const handler = async (event: AuthorizerRequest): Promise => {
const methodArn = event.methodArn;
try {
return await customAuthLogic(event.headers[‘Authorization’], methodArn, event.pathParameters[‘id’])
} catch (error) {
console.error(fatal error occurred in authorizer err=${JSON.stringify(error)});
throw new Error(‘Server Error’); // 500.
}
}

const customAuthLogic = async (authToken: string, methodArn: string, requestedUserId: string): Promise => {
const startTime = Date.now()

// Note: in a real api we would want to do a validation check(AuthN) first against
// passed ‘authToken’ to get the verified user id. Since this is just a simple demo
// we blindly trust the passed simple ID value.
//
// ex: Authorization: 1

// Now perform custom app Authz logic here were checking if the requesting user is
// a follower of the profile pic owner based off path parameter in api resource.

let user: undefined | User;
if (process.env[“CACHE_ENABLED”] === ‘true’) {
user = await ur.getCachedUser(requestedUserId);
} else {
user = await ur.getUser(requestedUserId);
}
if (!user) {
throw new Error(no user found requestedUserId=${requestedUserId});
}

if (user.followers.indexOf(authToken) < 0) {
console.info(non follower tried to access a profile pic requestedResourceUserId=${user.id} requestingUser=${authToken});
return generateAuthorizerRsp(authToken, DENY, methodArn, {})
}
console.info(successfully authenticated resource request requestedResourceUserId=${user.id} requestingUser=${authToken});
getMetricLogger().record([{
value: Date.now() – startTime,
labels: [{k: “CacheEnabled”, v: ${process.env["CACHE_ENABLED"]}}],
name: “authTime”
}]);
getMetricLogger().flush();
return generateAuthorizerRsp(authToken, ALLOW, methodArn, {id: authToken})
}

const generateAuthorizerRsp = (principalId: string, Effect: string, Resource: string, context: any) => ({
principalId,
policyDocument: {
Version: ‘2012-10-17’,
Statement: [{Action: ‘execute-api:Invoke’, Effect, Resource}],
},
context,
});

// Lambda for custom authorizer with cache
const customAuthLambdaWithCache = new NodejsFunction(this, ‘CustomAuthFunctionWithCache’, {
entry: join(__dirname, ‘../../src/functions’, ‘isFollowerAuthorizer.ts’),
…nodeJsFunctionProps,
environment: {
“RUNTIME”: “AWS”,
“CACHE_ENABLED”: “true”
}
});
// Lambda for custom authorizer with no cache
const customAuthLambdaNoCache = new NodejsFunction(this, ‘CustomAuthFunctionNoCache’, {
entry: join(__dirname, ‘../../src/functions’, ‘isFollowerAuthorizer.ts’),
…nodeJsFunctionProps,
environment: {
“RUNTIME”: “AWS”,
“CACHE_ENABLED”: “false”
}
});

// Read perms for lambdas
dynamoTable.grantReadData(customAuthLambdaWithCache);
dynamoTable.grantReadData(customAuthLambdaNoCache);

// Add profile-img api with custom authorizer that does not use caching
api.root.addResource(‘profile-pic’).addResource(‘{id}’,
{
defaultMethodOptions: {
authorizationType: AuthorizationType.CUSTOM,
authorizer: new RequestAuthorizer(this, ‘IsFollowerAuthorizerNoCache’, {
authorizerName: ‘authenticated-and-friends-no-cache’,
handler: customAuthLambdaNoCache,
// Don’t cache at GW level we want follower updates enforced
// as quickly as possible for this demo
resultsCacheTtl: Duration.seconds(0),
identitySources: [
IdentitySource.header(“Authorization”),
]
})
},
}
).addMethod(“GET”, svcLambdaIntegration);
// Add cached-profile-img api with custom authorizer that does use caching
api.root.addResource(‘cached-profile-pic’).addResource(‘{id}’,
{
defaultMethodOptions: {
authorizationType: AuthorizationType.CUSTOM,
authorizer: new RequestAuthorizer(this, ‘IsFollowerAuthorizerWithCache’, {
authorizerName: ‘authenticated-and-friends-with-cache’,
handler: customAuthLambdaWithCache,
// Don’t cache at GW level we want follower updates enforced as quickly as possible for this demo
resultsCacheTtl: Duration.seconds(0),
identitySources: [
IdentitySource.header(“Authorization”),
]
})
},
}
).addMethod(“GET”, svcLambdaIntegration);

$ curl https://j2azklgb6h.execute-api.us-east-1.amazonaws.com/prod/users/0 -s | jq .
{
“id”: “0”,
“followers”: [
“95”,
“77”,
“22”,
“65”,
“39”
],
“name”: “Relaxed Elephant”
}

$ curl -s -o /dev/null -w “\nStatus: %{http_code}\n” \
-H “Authorization: 22” \
https://j2azklgb6h.execute-api.us-east-1.amazonaws.com/prod/profile-pic/0

Status: 200
$

$ curl -s -o /dev/null -w “\nStatus: %{http_code}\n” \
-H “Authorization: 44” \
https://j2azklgb6h.execute-api.us-east-1.amazonaws.com/prod/profile-pic/0

Status: 403
$

$ for i in seq 1 100; do
curl -o /dev/null -H “Authorization: 22” https://j2azklgb6h.execute-api.us-east-1.amazonaws.com/prod/profile-pic/0 -s
done;

$ for i in seq 1 100; do
curl -o /dev/null -H “Authorization: 22” https://j2azklgb6h.execute-api.us-east-1.amazonaws.com/prod/cached-profile-pic/0 -s
done;