feat: apigw authorizer for amplify config endpoint

infra/lib/constructs/amplify-config-lambda-construct.ts

@@ -5,11 +5,13 @@
 
 import * as apigatewayv2 from "@aws-cdk/aws-apigatewayv2-alpha";
 import * as apigwIntegrations from "@aws-cdk/aws-apigatewayv2-integrations-alpha";
+import * as apigwAuthorizers from "@aws-cdk/aws-apigatewayv2-authorizers-alpha";
 import * as iam from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
-import * as cdk from 'aws-cdk-lib';
+import * as cdk from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { NagSuppressions } from "cdk-nag";
+import { IHttpRouteAuthorizer } from "@aws-cdk/aws-apigatewayv2-alpha";
 export interface AmplifyConfigLambdaConstructProps extends cdk.StackProps {
     /**
      * The Cognito UserPoolId to authenticate users in the front-end
@@ -51,7 +53,7 @@ export class AmplifyConfigLambdaConstruct extends Construct {
         const lambdaFn = new lambda.Function(this, "Lambda", {
             runtime: lambda.Runtime.PYTHON_3_9,
             handler: "index.lambda_handler",
-            code: lambda.Code.fromInline(this.getPythonLambdaFunction()), // TODO: support both python and typescript versions
+            code: lambda.Code.fromInline(this.getPythonLambdaFunction()),
             timeout: cdk.Duration.seconds(15),
             environment: {
                 USER_POOL_ID: props.userPoolId,
@@ -63,27 +65,39 @@ export class AmplifyConfigLambdaConstruct extends Construct {
         });
 
         // add lambda policies
-        // TODO: replace with specific dynamo resource assignment when table is in CDK
         lambdaFn.grantInvoke(new iam.ServicePrincipal("apigateway.amazonaws.com"));
 
         // add lambda integration
-        const lambdaFnIntegration = new apigwIntegrations.HttpLambdaIntegration("AmplifyConfigLambdaIntegration", lambdaFn);
+        const lambdaFnIntegration = new apigwIntegrations.HttpLambdaIntegration(
+            "AmplifyConfigLambdaIntegration",
+            lambdaFn
+        );
 
         // add route to the api gateway
         props.api.addRoutes({
             path: "/api/amplify-config",
             methods: [apigatewayv2.HttpMethod.GET],
             integration: lambdaFnIntegration,
-            // set authorizer to none since this route needs to be public
-            authorizer: new apigatewayv2.HttpNoneAuthorizer(),
+            authorizer: this.createNoOpAuthorizer(),
         });
+    }
+
+    private createNoOpAuthorizer(): IHttpRouteAuthorizer {
+        const authorizerFn = new cdk.aws_lambda.Function(this, "AuthorizerLambda", {
+            runtime: cdk.aws_lambda.Runtime.PYTHON_3_9,
+            handler: "index.lambda_handler",
+            code: cdk.aws_lambda.Code.fromInline(this.getAuthorizerLambdaCode()),
+            timeout: cdk.Duration.seconds(15),
+        });
+
+        authorizerFn.grantInvoke(new cdk.aws_iam.ServicePrincipal("apigateway.amazonaws.com"));
 
-        NagSuppressions.addResourceSuppressions(props.api, [
-            {
-                id: "AwsSolutions-APIG4",
-                reason: "required configuration for amplify to load for unauth users."
-            }
-        ], true);
+        return new apigwAuthorizers.HttpLambdaAuthorizer("authorizer", authorizerFn, {
+            authorizerName: "CognitoConfigAuthorizer",
+            resultsCacheTtl: cdk.Duration.seconds(3600),
+            identitySource: ["$context.routeKey"],
+            responseTypes: [apigwAuthorizers.HttpLambdaResponseType.SIMPLE],
+        });
     }
 
     private getPythonLambdaFunction(): string {
@@ -114,4 +128,13 @@ def lambda_handler(event, context):
   }
       `;
     }
+
+    private getAuthorizerLambdaCode(): string {
+        return `
+def lambda_handler(event, context): 
+    return {
+        "isAuthorized": True
+    }
+        `;
+    }
 }