using api gateway with aws cognito for protected routes

Question

So I'm going to put a public facing API up using AWS API Gateway, where I'll have back end lambda resources that handle the logic for each route (decoupled microservice).

What should I be storing in the JWT? Currently, I've disabled all read attributes, so the token only contains cognito:username , where in my database I will store this as the user id for each user. My understanding is that once a JWT is properly generated, I can use Cognito as an authorizer with API Gateway, and then once the token JWT details are received at the lambda layer, all I need to do is use the cognito:username key to lookup the user profile in my database.

Should I be implementing any other checks in the backend, or is it safe to rely on API gateway to pass the authenticated request?

Thanks!

Answer 1

The cognito API Gateway authorizer will only check if the token has not expired and if it belongs to the correct user pool. But since you will be extracting username from the token itself, you should be safe. Just make sure to configure API Gateway to pass Authorization header to the lambda, it does not do this by default.