Support for mapping Gateway Responses

[pcolmer]

I've got a custom authoriser set up as part of a project in Zappa. I want to be able to return a message that explains why access has been denied. This appears to require Gateway Responses to be set up ... but it doesn't look like Zappa supports this?

I did find #748 but that was closed due to inactivity.

Since Zappa does support custom authorisers, the addition of being able to define mappings for Gateway Responses would seem to be a useful feature to have.

Thank you.

[pcolmer]

I think that this can be done by adding an appropriate configuration section, and then extending create_api_gateway_routes to parse that section and add appropriate configuration to the CF template.

I'll raise a pull request.

[pcolmer]

OK - I do now have this working but it isn't quite as flexible as I had originally envisaged, so I'm not sure whether or not to raise a pull request.

It looks like there are only three ways that a Lambda authorizer can respond to being triggered by API Gateway:

1. A general exception - API Gateway treats this as a Lambda execution failure and returns 500 Internal Server Error.

2. A specific "Unauthorized" exception - API Gateway returns that as 401 Unauthorized.

3. An IAM policy of allow or deny.

Now, this is the big gotcha. While it is possible to extend Zappa to allow any of the custom Gateway Responses to be configured, NONE of them will receive a custom message from the Lambda authorizer except for an IAM Policy of Deny All.

It is possible to embed a context message into the deny IAM policy, and then configure ACCESS_DENIED to retrieve the message from the authorizer context.

So ... I have it returning a custom message through Deny All policies, but the overall solution is not as general purpose as one might have originally envisaged.

[github-actions]

Hi there! Unfortunately, this Issue has not seen any activity for at least 90 days. If the Issue is still relevant to the latest version of Zappa, please comment within the next 10 days if you wish to keep it open. Otherwise, it will be automatically closed.