Implement a secure tenant-based API key authorization system using Amazon Cognito, Amazon API Gateway, AWS Lambda Authorizer, and Amazon DynamoDB.
This pattern demonstrates how to implement a secure tenant-based API key authorization system using Amazon Cognito, Amazon API Gateway, Lambda Authorizer, and Amazon DynamoDB.
Amazon Cognito authenticates users and issues JWTs (ID tokens) containing a custom tenantId claim.
The client sends the JWT in the Authorization header. API Gateway forwards the token to the Lambda authorizer, which validates and decodes the JWT, extracts the custom:tenantId claim, and queries DynamoDB to retrieve the corresponding API key.
The authorizer returns a policy document with the usageIdentifierKey set to the API key, enabling API Gateway usage plan integration.
The API Gateway then allows or denies access to the protected endpoint based on the policy returned by the authorizer.
< Back to all patterns
Clone repo
git clone https://github.com/aws-samples/serverless-patterns/cd serverless-patterns/apigw-apikey-tenantid-cdkDeploy
npm installcdk deployTesting
See the GitHub repo for detailed testing instructions.
Cleanup
Delete the CDK stack:
cdk destroyCreated by:
