pulumi-aws-kotlin/com.pulumi.aws.apigateway.kotlin/AuthorizerArgs

AuthorizerArgs

data class AuthorizerArgs(val authorizerCredentials: Output<String>? = null, val authorizerResultTtlInSeconds: Output<Int>? = null, val authorizerUri: Output<String>? = null, val identitySource: Output<String>? = null, val identityValidationExpression: Output<String>? = null, val name: Output<String>? = null, val providerArns: Output<List<String>>? = null, val restApi: Output<String>? = null, val type: Output<String>? = null) : ConvertibleToJava<AuthorizerArgs>

Provides an API Gateway Authorizer.

Example Usage

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.apigateway.RestApi;
import com.pulumi.aws.iam.IamFunctions;
import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.lambda.Function;
import com.pulumi.aws.lambda.FunctionArgs;
import com.pulumi.aws.apigateway.Authorizer;
import com.pulumi.aws.apigateway.AuthorizerArgs;
import com.pulumi.aws.iam.RolePolicy;
import com.pulumi.aws.iam.RolePolicyArgs;
import com.pulumi.asset.FileArchive;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var demoRestApi = new RestApi("demoRestApi");
        final var invocationAssumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .effect("Allow")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .type("Service")
                    .identifiers("apigateway.amazonaws.com")
                    .build())
                .actions("sts:AssumeRole")
                .build())
            .build());
        var invocationRole = new Role("invocationRole", RoleArgs.builder()
            .path("/")
            .assumeRolePolicy(invocationAssumeRole.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
            .build());
        final var lambdaAssumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .effect("Allow")
                .actions("sts:AssumeRole")
                .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                    .type("Service")
                    .identifiers("lambda.amazonaws.com")
                    .build())
                .build())
            .build());
        var lambda = new Role("lambda", RoleArgs.builder()
            .assumeRolePolicy(lambdaAssumeRole.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json()))
            .build());
        var authorizer = new Function("authorizer", FunctionArgs.builder()
            .code(new FileArchive("lambda-function.zip"))
            .role(lambda.arn())
            .handler("exports.example")
            .build());
        var demoAuthorizer = new Authorizer("demoAuthorizer", AuthorizerArgs.builder()
            .restApi(demoRestApi.id())
            .authorizerUri(authorizer.invokeArn())
            .authorizerCredentials(invocationRole.arn())
            .build());
        final var invocationPolicyPolicyDocument = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
            .statements(GetPolicyDocumentStatementArgs.builder()
                .effect("Allow")
                .actions("lambda:InvokeFunction")
                .resources(authorizer.arn())
                .build())
            .build());
        var invocationPolicyRolePolicy = new RolePolicy("invocationPolicyRolePolicy", RolePolicyArgs.builder()
            .role(invocationRole.id())
            .policy(invocationPolicyPolicyDocument.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult).applyValue(invocationPolicyPolicyDocument -> invocationPolicyPolicyDocument.applyValue(getPolicyDocumentResult -> getPolicyDocumentResult.json())))
            .build());
    }
}
Content copied to clipboard

Import

Using pulumi import, import AWS API Gateway Authorizer using the REST-API-ID/AUTHORIZER-ID. For example:

$ pulumi import aws:apigateway/authorizer:Authorizer authorizer 12345abcde/example
Content copied to clipboard

Constructors

Link copied to clipboard
fun AuthorizerArgs(authorizerCredentials: Output<String>? = null, authorizerResultTtlInSeconds: Output<Int>? = null, authorizerUri: Output<String>? = null, identitySource: Output<String>? = null, identityValidationExpression: Output<String>? = null, name: Output<String>? = null, providerArns: Output<List<String>>? = null, restApi: Output<String>? = null, type: Output<String>? = null)

Functions

Link copied to clipboard
open override fun toJava(): AuthorizerArgs

Properties

Link copied to clipboard
val authorizerCredentials: Output<String>? = null

Credentials required for the authorizer. To specify an IAM Role for API Gateway to assume, use the IAM Role ARN.

Link copied to clipboard
val authorizerResultTtlInSeconds: Output<Int>? = null

TTL of cached authorizer results in seconds. Defaults to 300.

Link copied to clipboard
val authorizerUri: Output<String>? = null

Authorizer's Uniform Resource Identifier (URI). This must be a well-formed Lambda function URI in the form of arn:aws:apigateway:{region}:lambda:path/{service_api}, e.g., arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:012345678912:function:my-function/invocations

Link copied to clipboard
val identitySource: Output<String>? = null

Source of the identity in an incoming request. Defaults to method.request.header.Authorization. For REQUEST type, this may be a comma-separated list of values, including headers, query string parameters and stage variables - e.g., "method.request.header.SomeHeaderName,method.request.querystring.SomeQueryStringName,stageVariables.SomeStageVariableName"

Link copied to clipboard
val identityValidationExpression: Output<String>? = null

Validation expression for the incoming identity. For TOKEN type, this value should be a regular expression. The incoming token from the client is matched against this expression, and will proceed if the token matches. If the token doesn't match, the client receives a 401 Unauthorized response.

Link copied to clipboard
val name: Output<String>? = null

Name of the authorizer

Link copied to clipboard
val providerArns: Output<List<String>>? = null

List of the Amazon Cognito user pool ARNs. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}.

Link copied to clipboard
val restApi: Output<String>? = null

ID of the associated REST API

Link copied to clipboard
val type: Output<String>? = null

Type of the authorizer. Possible values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, or COGNITO_USER_POOLS for using an Amazon Cognito user pool. Defaults to TOKEN.