(apigatewayv2): Allow to set Lambda authorizer for WebSocket API

[tmokmss]

Please allow us to set a Lambda authorizer for a WebSocket API.
Currently we cannot set it because there's no interface for it.

Use Case

Restrict access to a WebSocket API by cognito auth or other auth method.

Proposed Solution

Setting an authorizer for a WebSocket API is simple.
You must only set authorizationType and authorizerId when creating a CfnRoute to $connect
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigatewayv2-route.html

Because you can only set authorizer for $connect route.

And there's only one authorizer type; LambdaAuthorizer.

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[nija-at]

We are unassigning and marking this issue as p2, which means that we are unable to work on this immediately.
We use +1s to help prioritize our work, and are happy to revaluate this issue based on community feedback. You can reach out to the cdk.dev community on Slack to solicit support for reprioritization.

[nija-at]

Originally posted by @michaelgmcd in #14085 (comment)

I was able to get to to work with a patch:

const wsApi = new WebSocketApi(stack, 'wsApi', {
    routeSelectionExpression: '$request.body.action',
    disconnectRouteOptions: {
      integration: new LambdaWebSocketIntegration({
        handler: lambdas.wsDisconnect,
      }),
    },
    defaultRouteOptions: {
      integration: new LambdaWebSocketIntegration({
        handler: lambdas.wsDefault,
      }),
    },
  });

  new WebSocketStage(stack, 'wsStage', {
    webSocketApi: wsApi,
    stageName: 'ws',
    autoDeploy: true,
    domainMapping: { domainName: wsDomainName },
  });

  const wsAuthorizer = new CfnAuthorizer(stack, 'WSAuthorizer', {
    name: 'wsAuthorizer',
    apiId: wsApi.apiId,
    authorizerType: 'REQUEST',
    authorizerUri: `arn:aws:apigateway:${constants.region}:lambda:path/2015-03-31/functions/${lambdas.wsAuth.functionArn}/invocations`,
    identitySource: ['route.request.querystring.token'],
  });

  wsApi.addRoute('$connect', {
    // @ts-ignore
    authorizerId: wsAuthorizer.ref,
    authorizationType: 'CUSTOM',
    integration: new LambdaWebSocketIntegration({
      handler: lambdas.wsConnect,
    }),
  });

node_modules/@aws-cdk/aws-apigatewayv2/lib/websocket/route.js

class WebSocketRoute extends core_1.Resource {
    /**
     * @experimental
     */
    constructor(scope, id, props) {
        super(scope, id);
        this.webSocketApi = props.webSocketApi;
        this.routeKey = props.routeKey;
        const config = props.integration.bind({
            route: this,
            scope: this,
        });
        const integration = props.webSocketApi._addIntegration(this, config);
        const route = new apigatewayv2_generated_1.CfnRoute(this, 'Resource', {
            apiId: props.webSocketApi.apiId,
            routeKey: props.routeKey,
            target: `integrations/${integration.integrationId}`,
            authorizerId: props.authorizerId, // <========================== Added this
            authorizationType: props.authorizationType, // <=================== Added this
        });
        this.routeId = route.ref;
    }
}

[tmokmss]

Also there is a sample for adding Lambda authorizer to a WebSocket API written in TypeScript.
https://github.com/aws-samples/websocket-api-cognito-auth-sample/blob/main/cdk/lib/construct/websocket.ts

[fr-an-k]

+1

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[wakeupmh]

@tmokmss @nija-at Did u have an example using an user pool and authorizerType with cognito?

[tmokmss]

@wakeupmh
Hi, here's an example for that. https://github.com/aws-samples/websocket-api-cognito-auth-sample/tree/main/cdk

You have to create a Lambda function to verify JWTs (implementation is very simple thanks to aws-jwt-veryfy lib), and use the function as a Lambda authorizer.

[wakeupmh]

@tmokmss in my case I translated to use L1 constructs anyway everything works fine, thanks a lot by your attention