Lambda Authorizer fails with invalid token after generating using apigClientFactory - amazon-web-services

Question

This is within a VUE project using VUEX.
The aim is to be able to control access to the API Gateway for both authenticated users and unauthenticated users.
In my Identity pool I can see that both authenticated and unauthenticated users are being picked up but I cannot get the Authorizer to accept the token that the SDK (aws-api-gateway-client) generates.
First I am getting accessKeyId etc
let AWS = require("aws-sdk");
AWS.config.region = env.aws.aws_cognito_region;
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId:
env.aws.aws_cognito_region +
":" +
env.aws.aws_cognito_identity_pool_id,
Logins: {
["cognito-idp." +
env.aws.aws_cognito_region +
".amazonaws.com/" +
env.aws
.aws_user_pools_id]: rootState.UserStore.authSession
.getIdToken()
.getJwtToken(),
},
});
AWS.config.credentials.get(function() {
commit("SET_ACCESS_CREDS", {
updatedAt: new Date(),
accessKeyId: AWS.config.credentials.accessKeyId,
secretAccessKey: AWS.config.credentials.secretAccessKey,
sessionToken: AWS.config.credentials.sessionToken,
});
});
These credentials looks good. I can output them and am happy they don't look broken.
Then I try to use these to access the api gateway using apigClientFactory.newClient
var apigClientFactory = require("aws-api-gateway-client").default;
var client = apigClientFactory.newClient({
accessKey: state.AccessCredentials.accessKeyId,
secretKey: state.AccessCredentials.secretAccessKey,
sessionToken: state.AccessCredentials.sessionToken,
region: env.aws.aws_cognito_region,
invokeUrl: process.env.VUE_APP_APIBASEURL,
});
console.log(client);
client.invokeApi({}, "/testauth", "GET").then(function(data) {
console.log(data);
});
My understanding here is that the SDK takes those values and generates what it needs to send to the API. I've read about it's algorithm, I don't understand it entirely but it implies it creates the access token and wraps it into a request.
The route testauth has the authorizer assigned.
The code for the authorizer is from the AWS doc
// A simple token-based authorizer example to demonstrate how to use an authorization token
// to allow or deny a request. In this example, the caller named 'user' is allowed to invoke
// a request if the client-supplied token value is 'allow'. The caller is not allowed to invoke
// the request if the token value is 'deny'. If the token value is 'unauthorized' or an empty
// string, the authorizer function returns an HTTP 401 status code. For any other token value,
// the authorizer returns an HTTP 500 status code.
// Note that token values are case-sensitive.
exports.handler = function(event, context, callback) {
var token = event.authorizationToken;
switch (token) {
case 'allow':
callback(null, generatePolicy('user', 'Allow', event.methodArn));
break;
case 'deny':
callback(null, generatePolicy('user', 'Deny', event.methodArn));
break;
case 'unauthorized':
callback("Unauthorized"); // Return a 401 Unauthorized response
break;
default:
callback("Error: Invalid token"); // Return a 500 Invalid token response
}
};
// Help function to generate an IAM policy
var generatePolicy = function(principalId, effect, resource) {
var authResponse = {};
authResponse.principalId = principalId;
if (effect && resource) {
var policyDocument = {};
policyDocument.Version = '2012-10-17';
policyDocument.Statement = [];
var statementOne = {};
statementOne.Action = 'execute-api:Invoke';
statementOne.Effect = effect;
statementOne.Resource = resource;
policyDocument.Statement[0] = statementOne;
authResponse.policyDocument = policyDocument;
}
// Optional output with custom properties of the String, Number or Boolean type.
authResponse.context = {
"stringKey": "stringval",
"numberKey": 123,
"booleanKey": true
};
return authResponse;
}
The cloudwatch logs for the authorizer say "Invalid token".
I don't see how it could be anything but that because all it's doing it just seems to be asking if the token says "allow" which seems a bit strange.
Am I by chance just using the wrong function to generate the token in this case?
It's surprising there isn't a comprehensive documentation on this type of requirement as it seems pretty standard.

Answer 1

In the end I am just validating the JWT token from Cognito which I got from here:
https://blog.mantalus.com/posts/apigw-custom-authorizer-cognito/
I do not use the API SDK