I have a custom authorizer for AWS Cognito using Node JS in Lambda and it works great. It's basically using the code provided in this tutorial.
There are a number of ways my custom authorizer can fail: the user is using the wrong pool, the user submitted an invalid authorization token, etc. Whenever this happens, I call:
context.fail("Unauthorized");
and that works well too.
Unfortunately, when the user's token has expired (which happens all the time, especially first thing in the morning if somebody left their browser open), I also call that same method, which is the only way I know of to return a 401 message. This works and the user is returned back to the login page.
The problem is that in my Cloudwatch dashboard, where we're monitoring for broken code / suspicious activity, every time somebody leaves their browser open we see a Lambda error. This is very noisy and makes it hard to catch somebody doing something suspicious.
So my question: How can I fail the authorizer, return a 401 (or something else), not have the REST API execute and also NOT have an error show up in CloudWatch?