如何在 AWS 无服务器 Function 上设置 Oauth 范围？

Question

Issue: OAuth Scopes are empty at Method Request Settings using Cloudformation and AWS-SAM

Apparently there are a few places where I can declare my authorization scopes, if I got it right, I should declare all scopes at the authorizer and the ones I would like to specify per function at my Function template.

This is the template I am trying to fix:

MyServerlessFn
 Type: AWS::Serverless::Function
    Properties:
      FunctionName: helloWorldFn
      Description: my test using cognito.
      Handler: src/handlers/helloWorld.handler
      Runtime: nodejs12.x
      Events:
        ApplicationPostAPI:
          Type: Api
          Properties:
            Auth:
              AuthorizationScopes:
                - https://foobar.acme.net/full-api
            Method: POST
            Path: /hello/world
            RestApiId: !Ref MyServerlessApi

using sam cli I can validate, build and deploy this template but the oauthScopes are empty when I check it using AWS web console.

Here the aws doc: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-function-apifunctionauth.html

Answer 1

I also noticed that the scopes you define on a function level stay empty. Whether the documentation is wrong or a current AWS SAM bug I leave in the midle. (see:https://github.com/aws/serverless-application-model/issues/1752 )

However you can solve this by specifying an authorizer on the api level and refer to this authorizer on function level.

  ApiGw:
    Type: AWS::Serverless::Api
    Properties:
      Description: some description
      Auth:
        Authorizers:
          DefaultAuthorizer:
            UserPoolArn: somepool
            AuthType: "COGNITO_USER_POOLS"
          AuthorizerWithScopeABC:
            UserPoolArn: somepool
            AuthType: "COGNITO_USER_POOLS"
            AuthorizationScopes:
              - /ABC
          AuthorizerWithScopeXYZ:
            UserPoolArn: somepool
            AuthType: "COGNITO_USER_POOLS"
            AuthorizationScopes:
              - /XYZ
        DefaultAuthorizer: DefaultAuthorizer

  Function:
    Type: AWS::Serverless::Function
    Properties:
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /somepath
            Method: get
            RestApiId: !Ref ApiGw
            Auth:
              Authorizer: AuthorizerWithScopeABC