CODEWITHSUNDEEP
javascriptaws-lambdaaws-api-gatewayserverless-frameworkserverless-architecture
THpubs
THpubs

Reputation: 8172

How to secure an AWS Lambda function?

I have a simple Lambda function which sends emails through SES. I can call it using a POST request with the required data and it will send an email. My question is, what are the methods I can use to secure this function? Currently, anyone can call that endpoint and execute the function with any data.

Upvotes: 6

Views: 2046

Answers (1)

Zanon
Zanon

Reputation: 30770

You need to set an authorizer for your API Gateway. This tutorial is a great start point.

In summary, you need to:

  1. Create a Cognito User Pool
  2. Create a Cognito Identity Pool that uses this User Pool
  3. Make the client to log in and retrieve Cognito credentials
  4. Make the client to send authorization headers for all requests
  5. Set an authorizer in your Lamba function

Your serverless.yml will look like this with the authorizer configuration:

functions:
  hello:
    handler: handler.hello
    events:
      - http:
          path: hello
          method: post
          authorizer:
            arn: YOUR_USER_POOL_ARN

You don't need to be restricted to a Cognito authorizer. You can use configure an authorizer for Google+, Facebook, etc.

This setting means that the Lamba function will be triggered only by authenticated users and you can identify what is the User ID by inspecting the event object: 

event.requestContext.authorizer.claims.sub

Upvotes: 12

Related Questions