CognitoIdentityID is empty in Go lambda function with Cognito authentication and API Gateway

user_12939172 0
Viewed 73

I have an AWS lambda function written in Go behind an API Gateway. I'm using Cognito with App integration and OAuth Client credentials grant for authentication. I need to know which App client sent the request inside the lambda function, but all the fields related to Cognito (CognitoIdentityID, CognitoIndetityPoolID, AccountID, etc.) are empty in the context and the request. I can only see the Bearer Authorization in the header of the request. I'm printing the values as follows:

var forwardRequest = func(ctx context.Context, request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    println(fmt.Sprintf("Request arrived: Stage: %s, Method: %s, Path: %s",
        request.RequestContext.Stage, request.HTTPMethod, request.Path))
    lc, _ := lambdacontext.FromContext(ctx)
    println(fmt.Sprintf("lc: %+v", lc))
    println(fmt.Sprintf("request: %+v", request))
    ...
}

func main() {
    // Make the handler available for Remote Procedure Call by AWS Lambda
    lambda.Start(forwardRequest)
}

I'm already using Lambda Proxy integration, as answered in similar questions. I attach a screenshot of the configuration of the API Gateway method. I can't enable "Invoke with caller credentials".

How can I know which client sent the request?.

aws-lambda go
1 Answers

I found the answer: Cognito's client ID is not in the Cognito* fields but in the Authorizer of the request:

func(ctx context.Context, request events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    var clientID string
    if claimsMap, ok := request.RequestContext.Authorizer["claims"].(map[string]interface{}); ok {
        clientID, ok = claimsMap["client_id"].(string)
        ...
    }
    ...
user_129391720
Related