Blog

Golang JWT authorizer for AWS API Gateway

05 Jul, 2023
Xebia Background Header Wave

When using AWS API Gateway you can use the AWS Lambda authorizer for HTTP APIs to authorize the requests. In this blog I will show you how to validate a JWT token signed with KMS in a Lambda using the Golang runtime. For the examples I am using API Gateway V2 with HTTP APIs with the v2 authorizer payload format version and for the resources I am using Terraform.

Why would you want to validate the JWT at the Gateway?

There are multiple benefits of validating the JWT token at the Gateway:

  • Not having to implement JWT logic in every service, reducing maintenance overhead
  • Increasing performance by caching the authorizer result for subsequent requests
  • Increasing security by slowing down attackers by using rate limiting and caching the authorizer result

If you decided not to implement JWT validation logic in every service you are relying fully on the API Gateway which could be a security risk. By having every service validate the JWT token you decrease the blast radius and making sure the API Gateway is not a single point of failure. So you have to look closely to your use case and business requirements and make a decision based on that.

How to set up the Lambda Authorizer

Below you find Golang Lambda code, the code can also be found on GitHub.

package main

import (
    "context"
    "os"

    "github.com/aws/aws-lambda-go/events"
    "github.com/aws/aws-lambda-go/lambda"
    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/kms"
    "github.com/matelang/jwt-go-aws-kms/v2/jwtkms"
    "github.com/golang-jwt/jwt/v5"
    "github.com/sirupsen/logrus"
)

var log = logrus.New()

var KmsKeyID = os.Getenv("KMS_JWT_KEY_ID")

func HandleRequest(ctx context.Context, request events.APIGatewayCustomAuthorizerRequestTypeRequest) (events.APIGatewayV2CustomAuthorizerSimpleResponse, error) {
    awsConfig, err := config.LoadDefaultConfig(context.TODO())
    if err != nil {
        log.Errorf("aws config failed to load %s", err)

        return events.APIGatewayV2CustomAuthorizerSimpleResponse{
            IsAuthorized: false,
        }, nil
    }

    kmsConfig := jwtkms.NewKMSConfig(kms.NewFromConfig(awsConfig), KmsKeyID, false)

    claims := jwt.RegisteredClaims{}

    _, err = jwt.ParseWithClaims(request.Headers["authorization"],
        &claims, func(token *jwt.Token) (interface{}, error) {
            return kmsConfig, nil
        })
    if err != nil {
        log.Errorf("can not parse/verify token %s", err)

        return events.APIGatewayV2CustomAuthorizerSimpleResponse{
            IsAuthorized: false,
        }, nil
    }

    log.Infof("validated token with claims: %v", claims)

    return events.APIGatewayV2CustomAuthorizerSimpleResponse{
        IsAuthorized: true,
    }, nil
}

func main() {
    lambda.Start(HandleRequest)
}

To add the Lambda Authorizer to the API Gateway you’ll need the following resources:

resource "aws_apigatewayv2_authorizer" "jwt" {
  api_id                            = APIGATEWAY_ARN // Add your API Gateway here
  authorizer_type                   = "REQUEST"
  authorizer_uri                    = aws_lambda_function.jwt_authorizer.invoke_arn
  identity_sources                  = ["$request.header.Authorization"]
  name                              = "jwt-authorizer"
  authorizer_payload_format_version = "2.0"
  enable_simple_responses           = true
}

resource "aws_lambda_function" "jwt_authorizer" {
  s3_bucket = "BUCKET_NAME"
  s3_key = "KEY"

  function_name = "jwt-authorizer"
  role          = aws_iam_role.lambda_execution.arn // The role needs 'kms:GetPublicKey' permissions
  handler       = "jwt-validator-lambda"

  environment {
    variables = {
      KMS_JWT_KEY_ID = aws_kms_key.jwt.id
    }
  }

  runtime = "go1.x"
}

resource "aws_lambda_permission" "api_gateway" {
  statement_id  = "AllowExecutionFromApiGateway"
  action        = "lambda:InvokeFunction"
  function_name = "jwt-authorizer"
  principal     = "apigateway.amazonaws.com"
  source_arn    = "arn:aws:execute-api:REGION_NAME:ACCOUNT_ID:${aws_apigatewayv2_api.main.id}/authorizers/${aws_apigatewayv2_authorizer.jwt.id}"
}

resource "aws_kms_key" "jwt" {
  description             = "jwt"
  deletion_window_in_days = 7

  customer_master_key_spec = "ECC_NIST_P521"
  key_usage                = "SIGN_VERIFY"
}

The Lambda function needs kms:GetPublicKey permissions to read the public key used to sign the JWT token.

Conclusion

In conclusion, validating JWT tokens at the API Gateway offers benefits such as reduced maintenance overhead, improved performance, and increased security. However, it is important to weigh these advantages against the potential risks and consider the specific needs of your application before deciding on the best approach.

Tibor Hercz
Tibor is a Cloud Consultant specialized in AWS with a strong background in Software engineering and has a passion for Compute, Networking and Security. His goal is to create simple Cloud Solutions that increases the efficiency and overall happiness of the teams and business. Sharing knowledge is important to him, so you will see him blogging and sharing knowledge about solutions he has built.
Questions?

Get in touch with us to learn more about the subject and related solutions

Explore related posts