Enable Provisioned Concurrency for a Lambda Authorizer

user_820947 0
Viewed 436

Using Terraform, I have a confiuration for an AWS HTTP API Gateway like so:

resource "aws_apigatewayv2_authorizer" "authorizer" {
  api_id = module.api_gateway.this_apigatewayv2_api_id
  name   = "authorizer"
  authorizer_payload_format_version = "2.0"
  enable_simple_responses           = true
  authorizer_result_ttl_in_seconds  = var.authorizer_result_ttl_in_seconds
  authorizer_type  = "REQUEST"
  identity_sources = ["$request.header.Authorization"]
 
  # Problem is below:
  authorizer_uri = module.auth-authorizer-lambda.this_lambda_function_invoke_arn
}

when I use this_lambda_function_invoke_arn, this works fine but a Concurrency-provisioned version of the Lambda is not called (so the Lambda can work for, like, 4s). Typically one can refer to such a version by this_lambda_function_qualified_arn, but using it would result in an error:

Error: error updating API Gateway v2 authorizer: BadRequestException: Invalid Authorizer URI:
arn:aws:lambda:eu-west-1:<account-id>:function:authorizer:5. 
Authorizer URI should be a valid API Gateway ARN that represents a Lambda function invocation.

How can I configure API gateway to use the particular version of an Authorizer lambda?

terraform-provider-aws aws-lambda terraform amazon-web-services
2 Answers

It is not shown what auth-authorizer-lambda module is, but the use of this_lambda_function_invoke_arn is incorrect. The correct form of authorizer_uri is shown in the following example:

arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations

So you have to construct and provide the authorizer_uri in the form as shown above. Obviously, it must be adjusted with your region, account id and function name.

user_2488230

If anyone else runs into this... you can configure API gateway to use the particular version of an Authorizer lambda by using the invoke_arn of the alias.

resource "aws_lambda_alias" "test_lambda_alias" {
  name             = "my_alias"
  description      = "a sample description"
  function_name    = aws_lambda_function.lambda_function_test.arn
  function_version = "1"
}

resource "aws_apigatewayv2_authorizer" "authorizer" {
  api_id = module.api_gateway.this_apigatewayv2_api_id
  name   = "authorizer"
  authorizer_payload_format_version = "2.0"
  enable_simple_responses           = true
  authorizer_result_ttl_in_seconds  = var.authorizer_result_ttl_in_seconds
  authorizer_type  = "REQUEST"
  identity_sources = ["$request.header.Authorization"]
 
  # Problem is below:
  authorizer_uri = aws_lambda_alias.test_lambda_alias.invoke_arn
}

Then, as always don't forget to deploy the change to a stage to take effect.

The final reference will be this format: arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}:{lambda_alias}/invocations

user_37570710
Related