DIfferent Cognito Pool Authorizer by Api Gateway Stages

Question

We have 3 stages on our API Gateway (Development, Testing, Production) they use a Cognito User Pool Authorizer for authorization, each one of the stages has a different User Pool so this configuration must be dynamic.

The problem: How do i configure the Auhtorizer for my API so that each API stage checks the authorization in the correct user pool?

PS: The Authorizer isn't a custom lambda function, it's the default Cognito authorizer.

Aniline

If you've found a solution please add it as an answer. – Florettaflorette

I didn't found any solution... – Aniline

I also haven't found any adequate one to have API Gateway + Lambda back end dev/prod stages where dev stage can be easily updated and prod would be like some manually pushed snapshot of dev. I ended up with having two API Gateways instances for dev and prod, using the same lambdas but without any parametrization (because the last requires manually setting permissions for every lambda). It relies on the idea that lambdas will be changed much more rapidly that API Gateway itself. And for dev $LATEST lamdas versions used, for prod manually selected ones. Lamdas get context by stage variables. – Florettaflorette

Answer 1

According to a thread on the AWS forums that has since been "archived", AWS doesn't currently support this.

Your best bet seems to be a multi-stack solution, where instead of stages you have separate APIs for the different environments.

See also this post for some more information.

Togs

The more info post is no longer available. – Cocks

Oh, that's unfortunate... Thanks for pointing it out @Cocks - I'll just delete it. – Togs

If you recall the info or can find another link to something similar it would be great to include it. Have a great day! – Cocks

More info post is available again, the forum thread has been archived however – Replica

Thanks @CanO'Spam, updated accordingly. – Togs

Answer 2

As @Rafael Soratto(Comment) suggested,

Step 1: Create a stage variable and give value the ARN of the AWS cognito pool.

Step 2: In cognito authorizer, rather than writing the cognito pool name write ${stageVariables.yourvariablename}. (Image)

And that's it.

Now, the cognito authorizer will behave according to the API gateway stages.

Ewart

Answer 3

You can do using StageVariables

stage variables

authorizer

Majoriemajority

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center. – Trovillion

Answer 4

It cant be done using stages variables in Api Gateway.

The solution that i have found is having different pool authorizers deployed for every stage. Not ideal bu its okey for me.

Continent

Can you share resources to help back this up with some context? – Replica

I tried that, works but it's extremely time consuming to setup and manage – Aureole

Answer 5

1 - Set stage variables for all your environments on API GW, in name use "cognito_pool_id" (or whatever you prefer) and in value add your cognito pool id for each environment.

2A - In case you already have your Test environment with authorizers all placed in your methods (under your api resources), just go to your current authorizer settings (in case you're already using a cognito authorizer for your methods) and change the static ARN for your stage variable

2B - In case your methods still don't have an authorizer using cognito or you're using a lambda authorizer, well, you gotta create a new authorizer (as we can't change the authorizer type) and set it up for all your methods (I hope you don't have too many methods because it consumes some time).

Here's an example of the ARN using stage var: arn:aws:cognito-idp:your-region:111222333444:userpool/${stageVariables.cognito_pool_id}

Pomfret