How to configure IAM authorizer for HTTP ApiGateway in AWS SAM?

Viewed 682

We have a service build with AWS SAM. Now we want to add authentication to it. We have one HTTP ApiGateway and we want to add an IAM authenticator to it. Unfortunately, I can't find any example or documentation on how to do that? I've tried, following options:

  exampleApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      CorsConfiguration: True
      DefinitionBody:
        'Fn::Transform':
          Name: 'AWS::Include'
          Parameters:
            Location: 'openapi.yaml'
      StageName: v2
      Auth:
        DefaultAuthorizer: AWS_IAM

and

  exampleApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      CorsConfiguration: True
      DefinitionBody:
        'Fn::Transform':
          Name: 'AWS::Include'
          Parameters:
            Location: 'openapi.yaml'
      StageName: v2

  fnExample:
    Type: AWS::Serverless::Function
    Properties:
      Handler: index.example
      Role: !GetAtt dataLambdaRole.Arn
      Events:
        getExample:
          Type: HttpApi
          Properties:
            Path: /example
            Method: get
            ApiId: !Ref exampleApi
            Auth:
              Authorizer: AWS_IAM

unfortunately, both of them finish with error. Can I ask you to share an example or instruction on how to configure the IAM authorizer for HTTP ApiGateway in AWS SAM template.

1 Answers

I think I found it. Unfortunately, it looks that currently (21 January 2021) it is impossible to confiure IAM security for HTTP API using SAM template. This is what I found in AWS documentation:

Mechanisms for controlling access AWS::Serverless::HttpApi AWS::Serverless::Api
Lambda authorizers
IAM permissions
Amazon Cognito user pools
API keys
Resource policies
OAuth 2.0/JWT authorizers

More details can be found here

There is some work on AWS side to fix that:

Related