自定义授权器是否是保护API Gateway后AWS Lambda的最优方案？

Great question—totally get why the double Lambda execution from custom authorizers feels inefficient. Let’s walk through practical alternatives to secure your proxy Lambda without that extra overhead:

Instead of splitting auth into a separate function, bake those checks right into your business Lambda. Keep it clean with these steps:

• Extract and validate tokens early: Pull the Authorization header from the API Gateway request, then use a lightweight library (like jsonwebtoken for Node.js or pyjwt for Python) to verify the token’s signature, expiration, and integrity.
• Map permissions to operations: Since you’re using /{proxy+} and ANY method, parse the request path and HTTP method to figure out what action the user is trying to take. Cross-reference that with permissions from the token’s claims (like roles or allowed actions).
• Fail fast: If validation fails or the user doesn’t have permission for the requested operation, immediately return a 401 Unauthorized or 403 Forbidden response before running any core business logic.

Pros: Only one Lambda runs per request—no extra latency from a separate authorizer.
Cons: Adds some auth boilerplate to your code, but you can keep it modular (e.g., a separate auth module) to avoid cluttering your business logic.

If your users are AWS identities (IAM users/roles, federated users via SAML/OIDC), skip custom authorizers entirely and use API Gateway’s native IAM integration:

• Enable IAM auth on your proxy resource: In the API Gateway console, set the authorization type to AWS_IAM for your /{proxy+} path.
• Lock down access with IAM policies: Create policies that allow execute-api:Invoke only for specific HTTP methods and paths your users should access. For example, a policy might let a user send POST requests to /orders/* but block DELETE actions.
• Sign requests properly: Users or client apps need to sign requests with AWS SigV4 credentials. Frontend apps can use AWS Amplify or the AWS SDK to handle this automatically.

Pros: No Lambda authorizer needed—auth is handled by AWS’s high-performance IAM service, so you avoid extra Lambda costs and latency.
Cons: Only works with AWS/IAM identities; not ideal if you’re using a completely custom user system (though you can federate custom users into IAM via OIDC).

If embedding auth logic or using IAM isn’t feasible, you can cut down on authorizer Lambda runs by enabling caching:

• Set up authorizer caching: In API Gateway, configure a cache TTL (e.g., 5 minutes) for your custom authorizer. Repeated requests from the same user (with the same valid token) will reuse the cached auth result instead of triggering the authorizer every time.
• Use token-based cache keys: Stick with the default cache key (based on the auth token) so each user’s permissions are cached separately. Just balance your TTL—make it short enough to handle permission changes, but long enough to reduce authorizer invocations.

Pros: Dramatically reduces the number of authorizer Lambda executions for repeat users.
Cons: Still has overhead for the first request or when the cache expires—doesn’t eliminate double Lambda runs entirely, but minimizes them.

If you’re using Cognito to manage user identities, use API Gateway’s native Cognito authorizer instead of a custom one:

• Link your Cognito pool to API Gateway: Attach your user pool as an authorizer to your /{proxy+} resource. API Gateway will automatically validate Cognito JWT tokens, check expiration, and pull user claims.
• Enforce permissions: Use Cognito groups to assign roles, then in your Lambda, check the cognito:groups claim to verify the user can perform the requested action. You can also use API Gateway’s request validation to block invalid requests before they hit your Lambda.

Pros: No custom authorizer Lambda needed—API Gateway handles token validation natively, blocking invalid requests early.
Cons: Tied to Cognito user pools, so it only works if you’re using Cognito for identity management.

Choose the approach that aligns with your identity system and performance goals: if you have custom users, embedding auth logic directly in your Lambda is the most efficient option. If you’re using AWS/IAM or Cognito, lean into the native integrations to skip extra Lambda overhead entirely.

内容的提问来源于stack exchange，提问作者Georgy Nemtsov