Part 2 - the Gateway - API Gateway APIs with Keycloak JWT authentication

In part 1 of this series I showed you how to setup an AWS Lambda with the AWS console.  Now, let's protect that Lambda with API Gateway and a JWT Authorizer, specifically with Keycloak.

The JWT Authorizer in API Gateway expects a standard JWT to be passed on every call to the API.  This leverages the standard Authorization header to pass the token. A curl call to the API might look like:

 

curl https://2ozg2rh13f.execute-api.us-west-2.amazonaws.com/default/api-gw-dad-joke
   -H "Accept: application/json"
   -H "Authorization: Bearer {token}"

 where the token is a JWT that looks something like:

eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJq ...

 

In the next article I'll show you where to get this token.  But first, let's put an API in front of the Lambda.

  

Note: once again I am showing you the "ClickOps" method of setting up your environment by doing everything though the AWS console.  This is not a best practice by any means.  Best practice is to use a toolkit such as AWS CDK or others to have an IaC (Infrastructure-as-Code) environment.  An IaC environment allows you to reproduce your overall infrastructure easily and allows much simpler auditing.  But this is a demo - it's not meant to be the be-all and end-all for AWS best practices.

Once you have the Lambda setup, the easiest way to begin to create an API Gateway is to leverage the UI to create the integration.  So, start by going to the AWS Console for Lambda and select your Lambda:

 and then "Add trigger".  In the next screen, select "API Gateway" in the select list:

Select "Create a new API" and then "HTTP API".  Note that at first we're going to select "Open" under "Security".  We'll secure it with JWT in just a few steps:

 

and select "Add".  The console with "think" for a second or two and bring you back to the Lambda screen:

Your Lambda is now available on the internet to be called!  Let's test it out. First, get the URL that was assigned to this integration by API Gateway.  Click on the "API Gateway" box in the image above to show the integration parameters:

Of course, your URL will be different than mine but the concept is the same.

Using your browser or Postman, go to the URL that you've been assigned.  In Postman, the response will be something like:

This is exactly what the service does - it acts as a proxy for the icanhazdadjoke.com API.  In this integration JSON is returned from the icanhazdadjoke.com API and that JSON is returned by the Lambda code behind the API Gateway.

But this API is now available to the world.  While it seems highly unlikely that someone would want to abuse this particular API - your service is likely to be a bit more interesting - it still should be protected from the world being able to access it.  See part 3 for the JWT part of the article.

 

Photo by Silas Köhler on Unsplash