How can I secure my Amazon API Gateway WebSocket API?
Last updated: 2022-11-04
I want to secure my Amazon API Gateway WebSocket API. How can I do this?
Amazon API Gateway supports the following methods for controlling and managing access to APIs:
- AWS Identity and Access Management (IAM) authorization
- AWS Lambda REQUEST authorizer function
For WebSocket APIs, make sure that your routes use an ARN in the following format:
For more information, see Using IAM authorization.
Lambda authorizer function
You can't use path variables (event.pathParameters) with Lambda authorizer functions for WebSocket APIs because the path is fixed. Make sure that the methodArn ends with "$connect" in the following format:
For more information, see Creating a Lambda REQUEST authorizer function.