Interface CfnAuthorizerProps
- All Superinterfaces:
software.amazon.jsii.JsiiSerializable
- All Known Implementing Classes:
CfnAuthorizerProps.Jsii$Proxy
CfnAuthorizer.
Example:
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import software.amazon.awscdk.services.apigateway.*;
CfnAuthorizerProps cfnAuthorizerProps = CfnAuthorizerProps.builder()
.name("name")
.restApiId("restApiId")
.type("type")
// the properties below are optional
.authorizerCredentials("authorizerCredentials")
.authorizerResultTtlInSeconds(123)
.authorizerUri("authorizerUri")
.authType("authType")
.identitySource("identitySource")
.identityValidationExpression("identityValidationExpression")
.providerArns(List.of("providerArns"))
.build();
- See Also:
-
Nested Class Summary
Nested ClassesModifier and TypeInterfaceDescriptionstatic final classA builder forCfnAuthorizerPropsstatic final classAn implementation forCfnAuthorizerProps -
Method Summary
Modifier and TypeMethodDescriptionstatic CfnAuthorizerProps.Builderbuilder()default StringSpecifies the required credentials as an IAM role for API Gateway to invoke the authorizer.default NumberThe TTL in seconds of cached authorizer results.default StringSpecifies the authorizer's Uniform Resource Identifier (URI).default StringOptional customer-defined field, used in OpenAPI imports and exports without functional impact.default StringThe identity source for which authorization is requested.default StringA validation expression for the incoming identity token.getName()The name of the authorizer.A list of the Amazon Cognito user pool ARNs for theCOGNITO_USER_POOLSauthorizer.The string identifier of the associated RestApi.getType()The authorizer type.Methods inherited from interface software.amazon.jsii.JsiiSerializable
$jsii$toJson
-
Method Details
-
getName
The name of the authorizer.- See Also:
-
getRestApiId
The string identifier of the associated RestApi.- See Also:
-
getType
The authorizer type.Valid values are
TOKENfor a Lambda function using a single authorization token submitted in a custom header,REQUESTfor a Lambda function using incoming request parameters, andCOGNITO_USER_POOLSfor using an Amazon Cognito user pool.- See Also:
-
getAuthorizerCredentials
Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer.To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.
- See Also:
-
getAuthorizerResultTtlInSeconds
The TTL in seconds of cached authorizer results.If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.
- See Also:
-
getAuthorizerUri
Specifies the authorizer's Uniform Resource Identifier (URI).For
TOKENorREQUESTauthorizers, this must be a well-formed Lambda function URI, for example,arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this formarn:aws:apigateway:{region}:lambda:path/{service_api}, where{region}is the same as the region hosting the Lambda function,pathindicates that the remaining substring in the URI should be treated as the path to the resource, including the initial/. For Lambda functions, this is usually of the form/2015-03-31/functions/[FunctionARN]/invocations.- See Also:
-
getAuthType
Optional customer-defined field, used in OpenAPI imports and exports without functional impact.- See Also:
-
getIdentitySource
The identity source for which authorization is requested.For a
TOKENorCOGNITO_USER_POOLSauthorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name isAuth, the header mapping expression ismethod.request.header.Auth. For theREQUESTauthorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if anAuthheader, aNamequery string parameter are defined as identity sources, this value ismethod.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of theREQUESTauthorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.- See Also:
-
getIdentityValidationExpression
A validation expression for the incoming identity token.For
TOKENauthorizers, this value is a regular expression. ForCOGNITO_USER_POOLSauthorizers, API Gateway will match theaudfield of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to theREQUESTauthorizer.- See Also:
-
getProviderArns
A list of the Amazon Cognito user pool ARNs for theCOGNITO_USER_POOLSauthorizer.Each element is of this format:
arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For aTOKENorREQUESTauthorizer, this is not defined.- See Also:
-
builder
- Returns:
- a
CfnAuthorizerProps.BuilderofCfnAuthorizerProps
-