AWS lambda : Passing data from custom authorizer to business lambda

Question

I am using custom authentication (with custom authorizer) for accessing AWS lambda. The authorization process works fine. But I have a problem to transmit data (ex principalId) between the authorizer lambda and the business lambda. All my lambdas are developed in JS. As explain in AWS doc, in the authorizer lambda, I add few simple fields (principalId in the code below) in context field of the Auth response. But in my business lambda, I am not able to get these fields. The AWS documentation talks about $context variable.

First, could you explain me if the $context variable is another variable or the same variable than the context variable received in parameter of the JS function?

Second, could you explain me how to get in my business lambda the data field (ex: principalId) provided by the authorizer?

Seb

Answer 1

The policy document of the authorizer can be enriched with a context where you can put your custom data. That data will be provided to the business lambda via the event.

Here is an example of a policy document:

const policy = {
    context: {
        customKey: 'payload data',
      },
    policyDocument: {
        Statement: [{
            Action: 'execute-api:Invoke',
            Effect: effect,
            Resource: resource,
        }],
        Version: '2012-10-17',
    },
    principalId: sub,
};

The context contains a "customKey" with payload data as a string.

The mapping template for your API then should look like this:

{
  "customKey": "$context.authorizer.customKey"
}

Finally in your business lambda you can access the value of your customKey via the event:

exports.handler = async (event, context) => {

console.log(event.customKey);

.
.
.
};

This should log "payload data" according to my example.

Notice that you cannot set a JSON object or array as a valid value of any key in the context map according to the documentation

Answer 2

I guess the $context variable you are referring to is the one available in the API Gateway mapping template. It is not equivalent to the context parameter of the business Lambda.

However, using the mapping template and its $context variable, you can build the event parameter of the business Lambda.

If the mapping template of your API endpoint looks like this:

{
  "principalId" : "$context.authorizer.principalId"
}

You should retrieve the principalId in the Lambda's event parameter.

Using the passthrough option, principalId should be available in event.context['authorizer-principal-id']. This is the default behavior when you create an endpoint.

---

References about mapping templates in the doc:

• http://docs.aws.amazon.com/apigateway/latest/developerguide/models-mappings.html#models-mappings-mappings
• http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html