How to Protect APIs Using Amazon Cognito User Pool

Amazon API Gateway is a fully managed service that makes it easy to handle REST APIs. The main task of this service is to bind an HTTP endpoint to a given backend service, like a Lambda function.

Fig.1 – Business logic exposed as REST API using Amazon API Gateway.

Suppose we are developing a client-side web or mobile application (e.g. Angular, Vue.js, etc.) for a newspaper. On the main page, we want to show the latest news, so we have created a /news resource that, when invoked using the HTTP’s GET verb will trigger the function GetLatestNews. This function might query a DynamoDB table to get the latest news and so returns them as a JSON (fig.1).

Well, now what if instead of calling GET /news, (a public API), an anonymous user tries a DELETE /news? This is a classic scenario in which you want to protect your endpoint from unauthenticated access. In this article, we will see how to achieve this, through few simple stages:

1. Create a REST API using Amazon API Gateway;
2. Create a Cognito User Pool;
3. Protect your API from unauthenticated access;
4. Test the solution;

Create a REST API using Amazon API…