API gateway websocket IAM authorizer - websocket

Question

I configured my $connect websocket route's auth to AWS_IAM however, I can still establish a connection without even signing the url with credentials. I expect that handshake should fail if url is not signed with valid credentials but it seems that the IAM authorizer is not being called/invoked. I tried signing the url with invalid credentials but it would just connect successfully.
Are there any other configurations that are needed?

Answer 1

After long hours of trying to make the IAM authorizer work for my websocket api, I have finally figured out the problem. I tried to manually create a custom lambda authorizer and applied to the $connect route and deployed the api. As expected, the custom authorizer worked. I changed it back to AWS_IAM authorizer and again, I manually deployed the api in the console and it finally worked. I think the reason is that since I have to configure the $connect route's authorizer via AWS::ApiGatewayV2::Route resource like this:
// serverless#2.16.0
resources: {
Resources: {
SconnectWebsocketsRoute: {
Type: 'AWS::ApiGatewayV2::Route',
Properties: {
AuthorizationType: 'AWS_IAM'
}
}
}
}
every time I perform serverless deploy -s stage --force, it somehow doesn't see this as a new changes in configuration thus it skips updating this in Cloudformation. I'm not 100% sure about this though so any other thoughts are welcome.