如何在 AWS Lambda 无服务器部署中对第三方 Webhook 请求进行身份验证

Question

I'm writing a function that handles the callback of a Stripe.com checkout session.

Basically, I receive some data in the body of the request, verify it with the Stripe node library, then I'm trying to write to Dynamodb to handle some backend business logic after the purchase is completed.

The problem is I need to keep this api endpoint open for Stripe to call it but also give the function authorization to write to dynamodb. When setting the authorizer: aws_iam , it requires the request to include an authentication token and when testing the webhook with Stripe it returns a "Missing Authentication Token" error.

When I remove the authorizer: aws_iam Stripe can call the webhook fine because the endpoint is open but then there's no permissions setup to allow writing to dynamodb. Seems like a catch22.

Here's my serverless:

handleCourseCheckout:
   handler: checkout_completed.main
   events:
      - http:
         path: webhook/purchased
         method: post
         cors: true
         authorizer: aws_iam

and here is where the authorizer aws_iam is defined:

provider:
  name: aws
  runtime: nodejs10.x
  stage: dev

  ......

  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:DescribeTable
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
      # Restrict our IAM role permissions to
      # the specific table for the stage
      Resource:
        - "Fn::ImportValue": TableArn

Answer 1

That's kinda strange. In your case you need to configure:

• API GW wide open ( authorizer: aws_iam means restriction access to api gw endpoint only)
• API GW must have permissions to invoke lambda function
• lambda function must have only access to DynamoDB
• remove CORS

Please - check lambda permissions (execution role) - check api gw (integration request role)