2.1.7 Application-Level Authorization

Client → Sign request with SigV4 → API Gateway → Verify IAM permissions

Client → API Gateway → Lambda Authorizer → Generate IAM Policy → Allow/Deny

def handler(event, context):
    token = event['authorizationToken']  # Bearer token
    # Validate token with third-party IdP
    if is_valid(token):
        return generate_policy('user', 'Allow', event['methodArn'])
    return generate_policy('user', 'Deny', event['methodArn'])

def generate_policy(principal_id, effect, resource):
    return {
        'principalId': principal_id,
        'policyDocument': {
            'Version': '2012-10-17',
            'Statement': [{
                'Action': 'execute-api:Invoke',
                'Effect': effect,
                'Resource': resource
            }]
        },
        'context': {
            'userId': '123',
            'role': 'admin'
        }
    }

Client → Get JWT from Cognito → API Gateway → Cognito Authorizer → Validate JWT