AWS CDK でLambdaオーソライザー（リクエスト）を実装して認証を試してみた

request-authorizer/
├── bin/
│   └── request-authorizer.ts
├── lib/
│   └── request-authorizer-stack.ts
├── lambda/
│   ├── request-authorizer.ts
│   └── backend.ts
...

import { APIGatewayRequestAuthorizerEvent, APIGatewayAuthorizerResult } from 'aws-lambda';

export const handler = async (event: APIGatewayRequestAuthorizerEvent): Promise<APIGatewayAuthorizerResult> => {
  // ① 認証に必要な情報をリクエストから取得
  const apiKey = event.headers?.['x-api-key'];
  const user = event.queryStringParameters?.['user'];

  // ② 認証ロジックの実行
  let effect: 'Allow' | 'Deny';
  let principalId: string;

  if (apiKey === 'request-key' && user === 'test-user') {
    // 認証情報が正しい場合
    effect = 'Allow';
    principalId = user;
  } else {
    // 認証情報が不正な場合
    effect = 'Deny';
    principalId = 'unknown-user';
  }

  // ③ IAMポリシーを返す
  return {
    principalId: principalId,
    policyDocument: {
      Version: '2012-10-17',
      Statement: [{
        Action: 'execute-api:Invoke',
        Effect: effect,
        Resource: event.methodArn,
      }],
    },
  };
};

import { APIGatewayProxyResult } from 'aws-lambda';

export const handler = async (): Promise<APIGatewayProxyResult> => {
  return {
    statusCode: 200,
    body: JSON.stringify({ message: 'Hello from a protected API!' }),
  };
};

import { Stack, StackProps, aws_apigateway as apigw } from 'aws-cdk-lib';
import { NodejsFunction } from 'aws-cdk-lib/aws-lambda-nodejs';
import { Runtime } from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';
import * as path from 'path';

// import * as sqs from 'aws-cdk-lib/aws-sqs';

export class RequestAuthorizerStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // バックエンドLambda関数の定義 (変更なし)
    const backendFunction = new NodejsFunction(this, 'BackendFunction', {
      runtime: Runtime.NODEJS_22_X,
      entry: path.join(__dirname, '..', 'lambda', 'backend.ts'),
      handler: 'handler',
    });

    // Lambdaオーソライザー関数の定義
    const authorizerFunction = new NodejsFunction(this, 'AuthorizerRequestFunction', {
      runtime: Runtime.NODEJS_22_X,
      entry: path.join(__dirname, '..', 'lambda', 'request-authorizer.ts'),
      handler: 'handler',
    });

    // API Gatewayの定義
    const api = new apigw.RestApi(this, 'MyProtectedRequestApi', {
      restApiName: 'MyProtectedRequestApi',
      description: 'API protected by a Lambda request authorizer',
    });

    // Lambdaオーソライザーの定義
    const authorizer = new apigw.RequestAuthorizer(this, 'MyLambdaRequestAuthorizer', {
      handler: authorizerFunction,
      identitySources: ['method.request.header.x-api-key', 'method.request.querystring.user'],
    });

    // バックエンド統合とメソッドの定義
    const backendIntegration = new apigw.LambdaIntegration(backendFunction);
    const helloResource = api.root.addResource('hello');
    helloResource.addMethod('GET', backendIntegration, {
      authorizer: authorizer,
    });
  }
}

curl -i -X GET "https://{API_ID}.execute-api.ap-northeast-1.amazonaws.com/prod/hello" -H "x-api-key: request-key"

HTTP/2 401 
~省略
{"message":"Unauthorized"}% 

curl -i -X GET "https://{API_ID}.execute-api.ap-northeast-1.amazonaws.com/prod/hello?user=test-user" -H "x-api-key: request-key"

HTTP/2 200
〜省略
{"message":"Hello from lambda API!"}