AWS SAM HttpApi - internal server error when adding lambda auth - amazon-web-services

Question

I've declared an HttpApi and a simple hello world function using AWS SAM template and it's working, I'm trying to add a lambda request authorizer now but I'm getting internal server error when testing it using Postman.
If I remove the required header "tokenID" the response is
{
"message": "Unauthorized"
}
if I add it:
{
"message": "Internal Server Error"
}
also, the access logs headers are empty, for example: BVharit1liAEMrw=: (-) -
Template:
Parameters:
StageName:
Type: String
Default: Prod
Resources:
HttpApiFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: hello-world
Handler: hello-world/app.lambdaHandler
Runtime: nodejs14.x
Events:
ExplicitApi:
Type: HttpApi
Properties:
ApiId: !Ref HttpApi
Method: GET
Path: /
TimeoutInMillis: 15000
PayloadFormatVersion: "2.0"
AuthFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: Auth
Handler: Auth/auth.lambdaHandler
Runtime: nodejs14.x
AccessLogs:
Type: AWS::Logs::LogGroup
HttpApi:
Type: AWS::Serverless::HttpApi
Properties:
CorsConfiguration:
AllowHeaders:
- tokenID
AllowMethods:
- GET
AllowOrigins:
- '*'
Auth:
DefaultAuthorizer: 'FirebaseAuth'
Authorizers:
FirebaseAuth:
FunctionInvokeRole: !GetAtt AuthFunctionRole.Arn
EnableSimpleResponses: true
AuthorizerPayloadFormatVersion: 2.0
FunctionArn: !GetAtt AuthFunction.Arn
Identity:
Headers:
- tokenID
StageName: !Ref StageName
AccessLogSettings:
DestinationArn: !GetAtt AccessLogs.Arn
Format: '$context.extendedRequestId: ($context.integrationErrorMessage) $event.headers'
Lambda request authorizer:
exports.lambdaHandler = async (event, context) => {
return {
"isAuthorized": true
}
}

Answer 1

Your lambda authorizer is not returning what is expected to be an actual lambda authorizer (an IAM policy). This is why you get that internal error when you turn it on.
To fix, replace is with something like this that returns an IAM policy (or rejects):
// A simple token-based authorizer example to demonstrate how to use an authorization token
// to allow or deny a request. In this example, the caller named 'user' is allowed to invoke
// a request if the client-supplied token value is 'allow'. The caller is not allowed to invoke
// the request if the token value is 'deny'. If the token value is 'unauthorized' or an empty
// string, the authorizer function returns an HTTP 401 status code. For any other token value,
// the authorizer returns an HTTP 500 status code.
// Note that token values are case-sensitive.
exports.handler = function(event, context, callback) {
var token = event.authorizationToken;
// modify switch statement here to your needs
switch (token) {
case 'allow':
callback(null, generatePolicy('user', 'Allow', event.methodArn));
break;
case 'deny':
callback(null, generatePolicy('user', 'Deny', event.methodArn));
break;
case 'unauthorized':
callback("Unauthorized"); // Return a 401 Unauthorized response
break;
default:
callback("Error: Invalid token"); // Return a 500 Invalid token response
}
};
// Help function to generate an IAM policy
var generatePolicy = function(principalId, effect, resource) {
var authResponse = {};
authResponse.principalId = principalId;
if (effect && resource) {
var policyDocument = {};
policyDocument.Version = '2012-10-17';
policyDocument.Statement = [];
var statementOne = {};
statementOne.Action = 'execute-api:Invoke';
statementOne.Effect = effect;
statementOne.Resource = resource;
policyDocument.Statement[0] = statementOne;
authResponse.policyDocument = policyDocument;
}
// Optional output with custom properties of the String, Number or Boolean type.
authResponse.context = {
"stringKey": "stringval",
"numberKey": 123,
"booleanKey": true
};
return authResponse;
}
Lots more information here : https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html#api-gateway-lambda-authorizer-lambda-function-create