examples icon indicating copy to clipboard operation
examples copied to clipboard

API Gateway Authorizer - IAM policy not caching

Open ghost opened this issue 4 years ago • 1 comments

I am trying to cache the IAM policy returned by the authorizer lambda when it validates the JWT token for the first time. I have enabled and set the authorizerResultTtlInSeconds to 3500 seconds in API Gateway Authorizer. However, I still see a request going to the Authorizer lambda function within the caching time frame as this shouldn't happen due to caching.

My node.js script is as below:

const jwt = require('jsonwebtoken');
const jwksClient = require('jwks-rsa');

const keyClient = jwksClient({
    jwksUri: process.env.JWKS_URI
})

const allow = {
    "principalId": "user",
    "policyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "execute-api:Invoke",
                "Effect": "Allow",
                "Resource": process.env.RESOURCE // RESOURCE = *
            }
        ]
    }
}

const unauthorized = {
    "error": "Unauthorized",
}

//excluded verificationJWTOptions object and getSigningKey function for simplicity
function validateJWTToken(token, callback) {
    jwt.verify(token, getSigningKey, verificationJWTOptions, (error) => {
        if (error) {
            callback(unauthorized)
        } else {
            callback(null, allow)
        }
    })
}

exports.handler = (event, context, callback) => {
    const token = extractTokenFromHeader(event);
    validateJWTToken(token, callback);
}

Not sure what I am missing out. Any help would be much appreciated!

ghost avatar Feb 28 '20 07:02 ghost

I'm seeing something similar. I setup a custom authorizer with a TLL of 120 seconds to cache on $context.identity.sourceIp. My lambda function seems to get invoked regardless of the cache length. I must have something misconfigured...? Although, I'm not even using serverless, I'm using the aws console to setup an api gateway. Maybe AWS has an issue.

codyseibert avatar Oct 15 '21 17:10 codyseibert