API Gateway REST API + Cognito User Pool Authorizer + Lambda Functionな構成をAWS CDK v2で構築してみた

import { Construct } from 'constructs';
import {
  Stack,
  StackProps,
  RemovalPolicy,
  aws_cognito,
  aws_lambda_nodejs,
  aws_apigateway,
} from 'aws-cdk-lib';

export interface AwsCdkV2AppStackProps extends StackProps {
  callbackUrls: string[];
  logoutUrls: string[];
  domainPrefix: string;
}

export class AwsCdkV2AppStack extends Stack {
  constructor(scope: Construct, id: string, props: AwsCdkV2AppStackProps) {
    super(scope, id, props);

    // User Pool
    const userPool = new aws_cognito.UserPool(this, 'userPool', {
      userPoolName: 'testUserPool',
      selfSignUpEnabled: false,
      standardAttributes: {
        email: { required: true, mutable: true },
        phoneNumber: { required: false },
      },
      signInCaseSensitive: false,
      autoVerify: { email: true },
      signInAliases: { email: true },
      accountRecovery: aws_cognito.AccountRecovery.EMAIL_ONLY,
      removalPolicy: RemovalPolicy.DESTROY,
    });

    // User Pool Domain
    userPool.addDomain('domain', {
      cognitoDomain: { domainPrefix: props.domainPrefix },
    }); //今回はログインUIを使わないので無くてもOK

    // User Pool Client
    userPool.addClient('client', {
      userPoolClientName: 'testUserPoolClient',
      generateSecret: false,
      oAuth: {
        callbackUrls: props.callbackUrls,
        logoutUrls: props.logoutUrls,
        flows: { authorizationCodeGrant: true },
        scopes: [
          aws_cognito.OAuthScope.EMAIL,
          aws_cognito.OAuthScope.OPENID,
          aws_cognito.OAuthScope.PROFILE,
        ],
      },
      authFlows: { adminUserPassword: true }, //cognitoIdp:adminInitiateAuth APIでユーザートークンを取得可能にする
    });

    // Lambda Function
    const lambdaFunc = new aws_lambda_nodejs.NodejsFunction(this, 'lambdaFunc');

    // Cognito Authorizer
    const cognitoAuthorizer = new aws_apigateway.CognitoUserPoolsAuthorizer(
      this,
      'cognitoAuthorizer',
      {
        authorizerName: 'CognitoAuthorizer',
        cognitoUserPools: [userPool],
      }
    );

    // Rest API
    const restApi = new aws_apigateway.RestApi(this, 'restApi');

    // Rest API Resource/Method
    restApi.root
      .addResource('data')
      .addMethod('GET', new aws_apigateway.LambdaIntegration(lambdaFunc), {
        authorizer: cognitoAuthorizer,
      });
  }
}

exports.handler = async () => {
  const response = {
    statusCode: 200,
    body: JSON.stringify({ greeting: 'Hello from Lambda!' }),
  };
  return response;
};

$ endpointUri=<endpointUri>
$ dataResourceUri=${endpointUri}data

$ userName=<userName>
$ userPassword=<userPassword>
$ userPoolId=<userPoolId>
$ clientId=<userPoolClientId>

$ idToken=$(aws cognito-idp admin-initiate-auth \
  --user-pool-id ${userPoolId} \
  --client-id ${clientId} \
  --auth-flow "ADMIN_USER_PASSWORD_AUTH" \
  --auth-parameters USERNAME=${userName},PASSWORD=${userPassword} \
  --query "AuthenticationResult.IdToken" \
  --output text)

$ curl -H "Authorization: ${idToken}" ${dataResourceUri}
{"greeting":"Hello from Lambda!"}