AWS CDK - adding Lambda Authorizer to HttpAPI & Eventbridge Integration

Viewed 38

I am building an API which gets triggered by external entity as a webhook URL. This API event, we need to pass through eventbridge and forward it to corresponding handler.

We have built AWS CDK Stack in which there is HttpAPI Integration with Eventbridge. Now, the problem is that we need to secure it with a custom Lambda Authorizer. And, We are not able to find a way to do the authorizer integration.


      const eventBus = new EventBus(this, 'MyEventBus', {
        eventBusName: 'MyEventBus'
      });
      /* LOGGING */
      const eventLoggerRule = new Rule(this, "EventLoggerRule", {
      description: "Log all events",
      eventPattern: {
        region: [ "us-east-1" ]
     },
      eventBus: eventBus
     });

      const logGroup = new LogGroup(this, 'EventLogGroup', {
      logGroupName: '/aws/events/MyEventBus',
      });

      eventLoggerRule.addTarget(new CloudWatchLogGroup(logGroup));

    const authHandler = new lambda.Function(this, 'WebhookAuthorizer', {
      runtime: lambda.Runtime.NODEJS_14_X,
      handler: 'index.handler',
      code: lambda.Code.fromAsset(path.join(__dirname, '../src/lambda')),
     });

    // create lambda authorizer
    const authorizer = new HttpLambdaAuthorizer('WebhookAuthorizer', authHandler, {
      responseTypes: [HttpLambdaResponseType.IAM], // Define if returns simple and/or iam response
    });

    const httpApi = new HttpApi(this, 'BIC', {
      description: 'Webhook Handler',
      corsPreflight: {
        allowHeaders: [
          'Content-Type',     
          'X-Amz-Date',
          'Authorization',
          'X-Api-Key',
        ],
        allowMethods: [
          CorsHttpMethod.OPTIONS,
          CorsHttpMethod.POST,
        ],
        allowCredentials: true,
        allowOrigins: ['http://localhost:3000'],
      },
    });


    /* There's no Eventbridge integration available as CDK L2 yet, so we have to use L1 and create Role, Integration and Route */
    const apiRole = new Role(this, 'EventBridgeIntegrationRole', {
      assumedBy: new ServicePrincipal('apigateway.amazonaws.com'),
    });

    apiRole.addToPolicy(
      new PolicyStatement({
        effect: Effect.ALLOW,
        resources: [eventBus.eventBusArn],
        actions: ['events:PutEvents'],
      })
    );

    const eventbridgeIntegration = new CfnIntegration(
      this,
      'EventBridgeIntegration',
      {
        apiId: httpApi.httpApiId,
        integrationType: 'AWS_PROXY',
        integrationSubtype: 'EventBridge-PutEvents',
        credentialsArn: apiRole.roleArn,
        requestParameters: {
          Source: 'WebApp',
          DetailType: 'MyDetailType', 
          Detail: '$request.body',
          EventBusName: eventBus.eventBusArn,
        },
        payloadFormatVersion: '1.0',
        timeoutInMillis: 10000
      }
    );

    const integ = new CfnIntegration(this, 'Integ', {
      apiId: api.httpApi.httpApiId,
      integrationType: 'AWS_PROXY',
      integrationSubtype: 'EventBridge-PutEvents',
      credentialsArn: serviceRole.roleArn,
      requestParameters: {
        Source: 'Gateway',
        Detail: '$request.body',
        DetailType: 'api-call',
        // EventBusName: eventBus.eventBusArn,
      },
      payloadFormatVersion: '1.0',
      timeoutInMillis: 10000,
    });
0 Answers
Related