CODEWITHSUNDEEP
amazon-web-servicesswaggeraws-api-gatewayopenapiterraform-provider-aws
Ali
Ali

Reputation: 253

aws api gateway header validation against matching pattern

I am creating an AWS API Gateway using terraform and openAPI specification with swagger. I need to add a request validator for validating the headers against a matching pattern [a-zA-z0-9]{10}. I was able to set up basic validator that checks if the header is empty or not but not able to validate with the pattern.

 "x-amazon-apigateway-request-validators" : {
    "full" : {
      "validateRequestBody" : true,
      "validateRequestParameters" : true,
       "validateRequestHeaders" : true
    },
    "body-only" : {
      "validateRequestBody" : true,
      "validateRequestParameters" : false
    }
  },
  "x-amazon-apigateway-request-validator" : "full",
  "paths": {
    "/validation": {
    "get": {
            "parameters": [
              {
                "in": "header",
                "name": "x-request-id",
                "required": true,
                "type": "string",
                "pattern" : "^[a-z0-9]{10}$"
              },
              {
                "in": "query",
                "name": "name",
                "required": true,
                "type": "string",
                "pattern": "^[a-zA-Z]{5}$"
              }
            ]
       }
}

Please suggest if there is any way to achieve that

Upvotes: 3

Views: 2336

Answers (2)

donbunkito
donbunkito

Reputation: 588

instead of

"type": "string",
"pattern" : "^[a-z0-9]{10}$"

it should read

"schema": {
  "type": "string",
  "pattern" : "^[a-z0-9]{10}$"
}

see also here

Upvotes: 0

Denis Weerasiri
Denis Weerasiri

Reputation: 1160

I can suggest a workaround for your requirement. You may use a "request based" Lambda authorizer and implement the validation logic within the Lambda function. If you need to validate just one header you may use 'token based' Lambda authorizer as well and specify a token validation regex.

Once the Lambda function determine whether the incoming headers are valid, it can grant access to the API.

You can check how to Configure a Lambda Authorizer Using the API Gateway Console.

Upvotes: 1

Related Questions