How to bypass authorization in internal lambda call

user_3636752 0
Viewed 400

I've implemented two lambda's (let's call A and B) behind api gateway. Assume A is called from "outside" and B is being called from outside and also from A. I've also implemented lambda Authorizer (token-based; cognito) as auth layer. Everything is working as expected. Is there a way to bypass authorizer process for B, for calls coming from A only?
Tnx

lambda-authorizer aws-lambda
1 Answers

There are multiple possibilities I have explored myself in the past for the exact same issue.

Change the calls to lambda:Invoke

Assuming you're generating some client code for your micro-services, you can create two versions of these clients:

  • external to call your service via HTTP API
  • internal to use lambda:Invoke operation straight to your micro-service.

Create a mirrored VPC-private API

This is probably feasible if you're deploying your infrastructure using CDK (or a similar alternative). Essentially, you keep your existing API where it is, and you create another internal version of it that does not have the authorizer. (Note that you may still want some sort of authorization process happening depending on the nature of your project.)

From this point on, you can pass the endpoint of your internal HTTP API to the Lambdas as environment variables and have them call that.

You can find more info about this, here. As a perk you should probably get lower latencies when talking to API Gateway as traffic through the VPC endpoints will only flow through AWS network, instead of going out on the internet and back in.

Move your workloads to ECS

This is perhaps a major change to your project, but one worth mentioning.

You can create true micro-services using ECS. You can run these services in private subnets of your VPC. In order not to have to deal with IP addresses yourself, you can explore multiple options:

  • have a VPC-internal Route53 Hosted Zone (more on this here). See more on ECS Service Discovery here
  • create Network Load Balancers in the private subnets of your VPCs and pass their endpoints to your services.
user_16737760
Related