How to create a resourse of API-Gatway authorizer, in serverless - amazon-web-services

Question

I using a cognito authorizer im my API, and using serverless to configure the api. For add a autorizer to a funcitions, i found this code (How to configure my Serverless YML to use my API Gateway Authorizer?):
teste:
handler: handler.teste
memorySize: 128
events:
- http:
path: teste
method: get
authorizer:
name: api-authorizer
arn: arn:aws:cognito-idp:XXXXXXXXX:XXXXXXXXXX:userpool/XXXXXXX_XXXXXXX
type: token
this code works very nice, but i need repeat a same authorizer in multiple functions, and using this code, for each function a new authorizer is create.... this is a waste of resourse and generete a mess in AWS console
For resolve this problem i try this:
teste:
handler: handler.teste
memorySize: 128
events:
- http:
path: teste
method: get
authorizer: myAuthorizer
resources:
Resources:
myAuthorizer:
Type: AWS::ApiGateway::Authorizer
Properties:
Name: "testing"
arn: arn:aws:cognito-idp:XXXXXXXXX:XXXXXXXXXX:userpool/XXXXXXX_XXXXXXX
authorizerId:
Ref: api-authorizer
But don't have success, and i didn't found documentations or guides for this.

Answer 1

In my opinion, it's not big of a deal to have the authorizer section repeated. In my case, it makes sense to have it repeated since we are using scopes.
listItems:
handler: handler.listItems
events:
- http:
method: get
path: /list-items
authorizer:
arn: ${self:custom.vars.${self:custom.vars.stage}.userPoolArn}
scopes:
- transactions/read
writeItem:
handler: handler.writeItem
events:
- http:
method: post
path: /write-item
authorizer:
arn: ${self:custom.vars.${self:custom.vars.stage}.userPoolArn}
scopes:
- transactions/write
But if you would like to share an authorizer it's here.
resources:
Resources:
ApiGatewayAuthorizer:
Type: AWS::ApiGateway::Authorizer
Properties:
AuthorizerResultTtlInSeconds: 300
IdentitySource: method.request.header.Authorization
Name: Cognito
RestApiId:
Ref: YourApiGatewayName
Type: COGNITO_USER_POOLS
ProviderARNs:
- arn:aws:cognito-idp:${self:provider.region}:xxxxxx:userpool/abcdef
functions:
deleteUser:
...
events:
- http:
path: /users/{userId}
...
# Provide both type and authorizerId
type: COGNITO_USER_POOLS # TOKEN or REQUEST or COGNITO_USER_POOLS, same as AWS Cloudformation documentation
authorizerId:
Ref: ApiGatewayAuthorizer # or hard-code Authorizer ID
Reference:
https://serverless.com/framework/docs/providers/aws/events/apigateway/#share-authorizer

Answer 2

What you are looking for is a certain type of API Gateway Authorizer, a Cognito Authorizer. These are specifically for authenticating users from a Cognito User Pool.
To use a Cognito Authorizer with serverless your serverless.yml could look something like this:
teste:
handler: handler.teste
memorySize: 128
events:
- http:
path: teste
method: get
authorizer:
arn: arn:aws:cognito-idp:XXXXXXXXX:XXXXXXXXXX:userpool/XXXXXXX_XXXXXXX
You aren't required to send the authorizer name or type when using a Cogntio Authorizer. Additionally, the arn should be pointing to your Cognito User Pool, which the one in your example appears to be.
Checkout the serverless documentation topic on custom authorizers if you want any more information or examples.