Ndtyjky

I am trying to create a custom Lambda authorizer that will be shared between a few different services/serverless stacks. If I understand the documentation here https://serverless.com/framework/docs/providers/aws/events/apigateway/#note-while-using-authorizers-with-shared-api-gateway, that means that I need to create a shared authorizer resource in a “common resources” service/serverless stack, and then refer to that shared authorizer from my other services. First of all: Is my understanding correct?

If my understanding is correct, my next question becomes: How do I do this? The documentation doesn’t provide a clear example for lambda authorizers, so here’s how I tried to customize it:

functions:

authorizerFunc:

handler: authorizer/authorizer.handler

runtime: nodejs8.10



resources:

Resources:

authorizer:

Type: AWS::ApiGateway::Authorizer

Properties:

AuthorizerResultTtlInSeconds: 0

Name: Authorizer

Type: REQUEST

AuthorizerUri: ???

RestApiId:

Fn::ImportValue: myRestApiId

I don’t understand what the syntax for AuthorizerUri is supposed to be. I’ve tried “Ref: authorizerFunc”, “Fn::GetAtt: [authorizerFunc, Arn]” etc. to no avail.

When I get the authorizerUri working, do I just add an Output for my authorizer resource, then Fn::ImportValue it from the services containing my API Lambdas?

Link to my question on the Serverless forum for posterity: https://forum.serverless.com/t/shared-lambda-authorizer/6447

I had the same issue that you describe. Or at least I think so. And I managed to get it solved by following the documentation on links you provided.

The serverless documentation states for the authorizer format to be

authorizer:

  # Provide both type and authorizerId

  type: COGNITO_USER_POOLS # TOKEN or COGNITO_USER_POOLS, same as AWS Cloudformation documentation

  authorizerId: 

    Ref: ApiGatewayAuthorizer  # or hard-code Authorizer ID

Per my understanding, my solution (provide below) follows the hard-coded authorizer ID approach.

In the service that has the shared authorizer, it is declared in the serverless.yml in normal fashion, i.e.

functions:

  myCustomAuthorizer:

    handler: path/to/authorizer.handler

    name: my-shared-custom-authorizer

Then in the service that wishes to use this shared authorizer, the function in servlerless.yml is declared as

functions:

  foo:

    # some properties ...

    events:

      - http:

          # ... other properties ...

          authorizer:

            name: authorize

            arn:

              Fn::Join:

                - ""

                - - "arn:aws:lambda"

                  # References to values such as region, account id, stage, etc

                  # Can be done with Pseudo Parameter Reference

                  - ":"

                  - "function:myCustomAuthorizer"

It was crucial to add the name property. It would not work without it, at least at the moment.

For details see

• ARN naming conventions


• Pseudo Parameter Reference


• Fn::Join

Unfortunately I cannot say whether this approach has some limitations compared to your suggestion of defining authorizer as a resource. In fact, that might make it easier to re-use the same authorizer in multiple functions within same service.