从 API 网关通过端点获取 OAuth 令牌

Question

I have an endpoint which I usually call only from within my application. The endpoint returns data from an internal only restful api. To call it my application must use an oauth client ID and secret to acquire a token. This happens within my app without any user involvement because the user has not need to know about it.

I want to migrate my app to AWS as a serverless application which means the entire logic can be moved into the static site portion hosted on S3.

The only problem is that because I would not need a lambda or other serverside application I have no method to retrieve the oauth token securely and cannot make the internal API call.

I was thinking I could make an API Gateway configuration which could acquire the token by retrieving the ID and secret from Secret Manager, make the oauth token call and then apply the token to the header of the internal passthrough request.

Is this possible or do I definitely need a serverside app to acquire the token first?

Example journey:

S3 via CloudFront serves VueJS site > JS calls public API Gateway endpoint > Endpoint calls Secret Manager to get oauth credentials > Endpoint calls internal corporate (private) api to get oauth token > Endpoint calls internal corporate (private) endpoint to get data, passing token in header > Endpoint returns data to client

Answer 1

You can do it with CloudFront Lambda @ Edge .

Since you're serving a static website with S3, putting it behind a CloudFront distribution will provide you the ability to serve your content securely with HTTPS (easier with AWS Certificate Manager ACM ) and add an authentication flow by setting a Lambda@Edge function in the CloudFront distribution's ViewerRequest .

Here are some examples of how to implement it:

• AWS blog-post - Authorization@Edge using cookies: Protect your Amazon CloudFront content from being downloaded by unauthenticated users
• AWS GitHub example -aws-samples/cloudfront-authorization-at-edge
• Another GitHub example - Widen/cloudfront-auth
• I also wanted to modify the ViewerResponse , so I created my own implementation of the previous example - devops-internal/cloudfront-auth

I usually use this solution to protect the staging environment (which is "public") from unknown users. Please mind the costs of this solution, see Lambda@Edge Pricing . If it's for a large organization, then this solution might be costly.