Writing authorizers for serverless framework in Ruby - ruby

Question

I'm attempting to write an authorizer to protect calls to a lambda using the serverless framework. I'm using Ruby.
Configuration:
provider:
name: aws
runtime: ruby2.5
iamRoleStatements:
- Effect: Allow
Action:
- KMS:Decrypt
Resource: ${self:custom.kmsSecrets.keyArn}
functions:
authorize:
handler: handler.authorize
hello:
handler: handler.protected
events:
- http:
path: protected
method: get
authorizer: authorize
The authorizer:
def authorize(event:, context:)
if is_authorized?
{
"policyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "execute-api:Invoke",
"Resource": [ context.invoked_function_arn ],
"Effect": "Allow"
}
]
},
"principalId": "seeker"
}.to_json
end
end
The authentication I'd like to implement is token based: the is_authorized? method would receive the token and then return a policy that would allow access to the protected lambda function.
I'm not entirely sure what goes in the PrincipalId argument - I have no user.id.
Right now it complains that: seeker-dev-authorize is not authorized to perform: iam:CreatePolicy on resource: policy seeker-allowed which leaves me quite confused: I can't create a policy... on the policy? And where should I set this permission? On IAM or serverless.yml? Because I've set the permissions to encode/decode keys in serverless, maybe I should do the same with this?

Answer 1

I haven't used custom authorizers before, but I put together a small hello world project to try this out and this is what I found.
The protected function and the authorizer function:
def authorize(event:, context:)
{
"principalId": "test",
"policyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "execute-api:Invoke",
"Effect": "Allow",
"Resource": event["methodArn"]
}
]
}
}
end
def hello(event:, context:)
{ statusCode: 200, body: JSON.generate('This is a protected endpoint!') }
end
Note that I'm returning the hash and not a string with to_json, I got an error back from the authorizer when using to_json.
Also note that I'm using event["methodArn"] to get the protected lambda ARN, using context.invoked_function_arn also caused me an error.
Besides that, not including an Authorization header in the request, will return an "Unauthorized error":
curl -X GET https://endpoint/dev/hello -H 'Authorization: test'
Lastly, about the principalId:
The principalId is a required property on your authorizer response. It represents the principal identifier for the caller. This may vary from application-to-application, but it could be a username, an email address, or a unique ID.
Source: https://www.alexdebrie.com/posts/lambda-custom-authorizers/