Aws Lambda - how to persist valid tokens for use with other invocations

user_1305579 0
Viewed 3344

I have setup api gateway with cognito authentication, but need to pass some of the requests to another rest service which has own authentication where you need to supply clientID and secret to receive a bearer token that is valid for several hours.

I do not need to make any change to the request, just add the token and pass it to the rest service and receive the answer and pass it to the client.

As the token will be valid for several hours, I do not want to ask for the token with every request to save time.

Where can I persist the valid token? Api-gateway or a lambda function? Lambda function is stateless and has no storage as far as I know.

Thanks

aws-api-gateway aws-lambda
2 Answers

There are multiple ways to achieve this. I'm giving you two suggestions that I think could make sense in your case:

Cache key in Lambda instance

You can cache data in your Lambda function. This usually happens in the code outside of the Lambda handler function (e.g. for Node.js everything outside of your handler function is initialized before your handler function is called).

Yes, you are right that a Lambda function should be stateless. However, function instances are being reused. Therefore, if you are sure that your Lambda function is only used for this one purpose (i.e. it's safe to cache such key) and you can call the external endpoint with the same key for some time, you can tweak the performance by caching it and only update it as soon as its expired. This way, you need to retrieve the key on the first invocation and only read it for every other invocation of the same function instance. (Alternatively, store the data in a file in /tmp if you don't trust this caching mechanism) I have written a blog post about caching in AWS Lambda some while ago which explains this approach in more detail. Let me know if you have questions.

Advantage: caching within your code is relatively easy.

Store key in Secrets Manager

Instead of retrieving and caching the key in the same Lambda function, you could "outsource" it to the Secrets Manager. This means, you add a new key/secret in Secrets Manager and attach a separate Lambda function rotating the key every few hours before it expires. Then, in your original Lambda function you just retrieve the key from Secrets Manager. In order to optimize the Lambda costs and performance a bit, I'd still suggest to cache the key for some time as described above.

Advantage: separation of concerns.

user_48312970

Get a token during your lambda bootstraps, write it to parameter store as a secure string, get it from parameter store when needed or hold it in-memory (depending on how often you expect the lambda to run)?, when the token is expired and your app is still running, just re-call the method and write it again to parameter store

user_131552170
Related