Amazonka.APIGateway.CreateAuthorizer

Adds a new Authorizer resource to an existing RestApi resource.

Creating a Request

data CreateAuthorizer

Request to add a new Authorizer to an existing RestApi resource.

See: newCreateAuthorizer smart constructor.

Constructors

CreateAuthorizer'

Fields

• authType :: Maybe Text

  Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

• authorizerCredentials :: Maybe Text

  Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

• authorizerResultTtlInSeconds :: Maybe Int

  The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

• authorizerUri :: Maybe Text

  Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

• identitySource :: Maybe Text

  The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

• identityValidationExpression :: Maybe Text

  A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

• providerARNs :: Maybe [Text]

  A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

• restApiId :: Text

  The string identifier of the associated RestApi.

• name :: Text

  The name of the authorizer.

• type' :: AuthorizerType

  The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

Instances

ToJSON CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

toJSON :: CreateAuthorizer -> Value

toEncoding :: CreateAuthorizer -> Encoding

toJSONList :: [CreateAuthorizer] -> Value

toEncodingList :: [CreateAuthorizer] -> Encoding

ToHeaders CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

toHeaders :: CreateAuthorizer -> [Header]

ToPath CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

toPath :: CreateAuthorizer -> ByteString

ToQuery CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

toQuery :: CreateAuthorizer -> QueryString

AWSRequest CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Associated Types

type AWSResponse CreateAuthorizer

Methods

request :: (Service -> Service) -> CreateAuthorizer -> Request CreateAuthorizer

response :: MonadResource m => (ByteStringLazy -> IO ByteStringLazy) -> Service -> Proxy CreateAuthorizer -> ClientResponse ClientBody -> m (Either Error (ClientResponse (AWSResponse CreateAuthorizer)))

Generic CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Associated Types

type Rep CreateAuthorizer :: Type -> Type

Methods

from :: CreateAuthorizer -> Rep CreateAuthorizer x

to :: Rep CreateAuthorizer x -> CreateAuthorizer

Read CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

readsPrec :: Int -> ReadS CreateAuthorizer

readList :: ReadS [CreateAuthorizer]

readPrec :: ReadPrec CreateAuthorizer

readListPrec :: ReadPrec [CreateAuthorizer]

Show CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

showsPrec :: Int -> CreateAuthorizer -> ShowS

show :: CreateAuthorizer -> String

showList :: [CreateAuthorizer] -> ShowS

NFData CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

rnf :: CreateAuthorizer -> ()

Eq CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

(==) :: CreateAuthorizer -> CreateAuthorizer -> Bool

(/=) :: CreateAuthorizer -> CreateAuthorizer -> Bool

Hashable CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

Methods

hashWithSalt :: Int -> CreateAuthorizer -> Int

hash :: CreateAuthorizer -> Int

type AWSResponse CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

type AWSResponse CreateAuthorizer = Authorizer

type Rep CreateAuthorizer

Defined in Amazonka.APIGateway.CreateAuthorizer

type Rep CreateAuthorizer = D1 ('MetaData "CreateAuthorizer" "Amazonka.APIGateway.CreateAuthorizer" "amazonka-apigateway-2.0-zw0Lbt4rUGxZBjJ4Rpfi" 'False) (C1 ('MetaCons "CreateAuthorizer'" 'PrefixI 'True) (((S1 ('MetaSel ('Just "authType") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "authorizerCredentials") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text))) :*: (S1 ('MetaSel ('Just "authorizerResultTtlInSeconds") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Int)) :*: (S1 ('MetaSel ('Just "authorizerUri") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "identitySource") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text))))) :*: ((S1 ('MetaSel ('Just "identityValidationExpression") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "providerARNs") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [Text]))) :*: (S1 ('MetaSel ('Just "restApiId") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :*: (S1 ('MetaSel ('Just "name") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 Text) :*: S1 ('MetaSel ('Just "type'") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 AuthorizerType))))))

newCreateAuthorizer

Arguments

:: Text

CreateAuthorizer

-> Text

CreateAuthorizer

-> AuthorizerType

CreateAuthorizer

-> CreateAuthorizer

Create a value of CreateAuthorizer with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

CreateAuthorizer, createAuthorizer_authType - Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

CreateAuthorizer, createAuthorizer_authorizerCredentials - Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

CreateAuthorizer, createAuthorizer_authorizerResultTtlInSeconds - The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

CreateAuthorizer, createAuthorizer_authorizerUri - Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

CreateAuthorizer, createAuthorizer_identitySource - The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

CreateAuthorizer, createAuthorizer_identityValidationExpression - A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

CreateAuthorizer, createAuthorizer_providerARNs - A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

CreateAuthorizer, createAuthorizer_restApiId - The string identifier of the associated RestApi.

CreateAuthorizer, createAuthorizer_name - The name of the authorizer.

CreateAuthorizer, createAuthorizer_type - The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

Request Lenses

createAuthorizer_authType :: Lens' CreateAuthorizer (Maybe Text)

Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

createAuthorizer_authorizerCredentials :: Lens' CreateAuthorizer (Maybe Text)

Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

createAuthorizer_authorizerResultTtlInSeconds :: Lens' CreateAuthorizer (Maybe Int)

The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

createAuthorizer_authorizerUri :: Lens' CreateAuthorizer (Maybe Text)

Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

createAuthorizer_identitySource :: Lens' CreateAuthorizer (Maybe Text)

The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

createAuthorizer_identityValidationExpression :: Lens' CreateAuthorizer (Maybe Text)

A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

createAuthorizer_providerARNs :: Lens' CreateAuthorizer (Maybe [Text])

A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

createAuthorizer_restApiId :: Lens' CreateAuthorizer Text

The string identifier of the associated RestApi.

createAuthorizer_name :: Lens' CreateAuthorizer Text

The name of the authorizer.

createAuthorizer_type :: Lens' CreateAuthorizer AuthorizerType

The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

Destructuring the Response

data Authorizer

Represents an authorization layer for methods. If enabled on a method, API Gateway will activate the authorizer when a client calls the method.

See: newAuthorizer smart constructor.

Constructors

Authorizer'

Fields

• authType :: Maybe Text

  Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

• authorizerCredentials :: Maybe Text

  Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

• authorizerResultTtlInSeconds :: Maybe Int

  The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

• authorizerUri :: Maybe Text

  Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

• id :: Maybe Text

  The identifier for the authorizer resource.

• identitySource :: Maybe Text

  The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

• identityValidationExpression :: Maybe Text

  A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

• name :: Maybe Text

  The name of the authorizer.

• providerARNs :: Maybe [Text]

  A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

• type' :: Maybe AuthorizerType

  The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

Instances

FromJSON Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

Methods

parseJSON :: Value -> Parser Authorizer

parseJSONList :: Value -> Parser [Authorizer]

Generic Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

Associated Types

type Rep Authorizer :: Type -> Type

Methods

from :: Authorizer -> Rep Authorizer x

to :: Rep Authorizer x -> Authorizer

Read Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

Methods

readsPrec :: Int -> ReadS Authorizer

readList :: ReadS [Authorizer]

readPrec :: ReadPrec Authorizer

readListPrec :: ReadPrec [Authorizer]

Show Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

Methods

showsPrec :: Int -> Authorizer -> ShowS

show :: Authorizer -> String

showList :: [Authorizer] -> ShowS

NFData Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

Methods

rnf :: Authorizer -> ()

Eq Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

Methods

(==) :: Authorizer -> Authorizer -> Bool

(/=) :: Authorizer -> Authorizer -> Bool

Hashable Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

Methods

hashWithSalt :: Int -> Authorizer -> Int

hash :: Authorizer -> Int

type Rep Authorizer

Defined in Amazonka.APIGateway.Types.Authorizer

type Rep Authorizer = D1 ('MetaData "Authorizer" "Amazonka.APIGateway.Types.Authorizer" "amazonka-apigateway-2.0-zw0Lbt4rUGxZBjJ4Rpfi" 'False) (C1 ('MetaCons "Authorizer'" 'PrefixI 'True) (((S1 ('MetaSel ('Just "authType") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "authorizerCredentials") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text))) :*: (S1 ('MetaSel ('Just "authorizerResultTtlInSeconds") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Int)) :*: (S1 ('MetaSel ('Just "authorizerUri") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "id") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text))))) :*: ((S1 ('MetaSel ('Just "identitySource") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: S1 ('MetaSel ('Just "identityValidationExpression") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text))) :*: (S1 ('MetaSel ('Just "name") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe Text)) :*: (S1 ('MetaSel ('Just "providerARNs") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe [Text])) :*: S1 ('MetaSel ('Just "type'") 'NoSourceUnpackedness 'NoSourceStrictness 'DecidedStrict) (Rec0 (Maybe AuthorizerType)))))))

newAuthorizer :: Authorizer

Create a value of Authorizer with all optional fields omitted.

Use generic-lens or optics to modify other optional fields.

The following record fields are available, with the corresponding lenses provided for backwards compatibility:

$sel:authType:Authorizer', authorizer_authType - Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

$sel:authorizerCredentials:Authorizer', authorizer_authorizerCredentials - Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

$sel:authorizerResultTtlInSeconds:Authorizer', authorizer_authorizerResultTtlInSeconds - The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

$sel:authorizerUri:Authorizer', authorizer_authorizerUri - Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

$sel:id:Authorizer', authorizer_id - The identifier for the authorizer resource.

$sel:identitySource:Authorizer', authorizer_identitySource - The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

$sel:identityValidationExpression:Authorizer', authorizer_identityValidationExpression - A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

$sel:name:Authorizer', authorizer_name - The name of the authorizer.

$sel:providerARNs:Authorizer', authorizer_providerARNs - A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

$sel:type':Authorizer', authorizer_type - The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.

Response Lenses

authorizer_authType :: Lens' Authorizer (Maybe Text)

Optional customer-defined field, used in OpenAPI imports and exports without functional impact.

authorizer_authorizerCredentials :: Lens' Authorizer (Maybe Text)

Specifies the required credentials as an IAM role for API Gateway to invoke the authorizer. To specify an IAM role for API Gateway to assume, use the role's Amazon Resource Name (ARN). To use resource-based permissions on the Lambda function, specify null.

authorizer_authorizerResultTtlInSeconds :: Lens' Authorizer (Maybe Int)

The TTL in seconds of cached authorizer results. If it equals 0, authorization caching is disabled. If it is greater than 0, API Gateway will cache authorizer responses. If this field is not set, the default value is 300. The maximum value is 3600, or 1 hour.

authorizer_authorizerUri :: Lens' Authorizer (Maybe Text)

Specifies the authorizer's Uniform Resource Identifier (URI). For TOKEN or REQUEST authorizers, this must be a well-formed Lambda function URI, for example, arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:{account_id}:function:{lambda_function_name}/invocations. In general, the URI has this form arn:aws:apigateway:{region}:lambda:path/{service_api}, where {region} is the same as the region hosting the Lambda function, path indicates that the remaining substring in the URI should be treated as the path to the resource, including the initial /. For Lambda functions, this is usually of the form /2015-03-31/functions/[FunctionARN]/invocations.

authorizer_id :: Lens' Authorizer (Maybe Text)

The identifier for the authorizer resource.

authorizer_identitySource :: Lens' Authorizer (Maybe Text)

The identity source for which authorization is requested. For a TOKEN or COGNITO_USER_POOLS authorizer, this is required and specifies the request header mapping expression for the custom header holding the authorization token submitted by the client. For example, if the token header name is Auth, the header mapping expression is method.request.header.Auth. For the REQUEST authorizer, this is required when authorization caching is enabled. The value is a comma-separated string of one or more mapping expressions of the specified request parameters. For example, if an Auth header, a Name query string parameter are defined as identity sources, this value is method.request.header.Auth, method.request.querystring.Name. These parameters will be used to derive the authorization caching key and to perform runtime validation of the REQUEST authorizer by verifying all of the identity-related request parameters are present, not null and non-empty. Only when this is true does the authorizer invoke the authorizer Lambda function, otherwise, it returns a 401 Unauthorized response without calling the Lambda function. The valid value is a string of comma-separated mapping expressions of the specified request parameters. When the authorization caching is not enabled, this property is optional.

authorizer_identityValidationExpression :: Lens' Authorizer (Maybe Text)

A validation expression for the incoming identity token. For TOKEN authorizers, this value is a regular expression. For COGNITO_USER_POOLS authorizers, API Gateway will match the aud field of the incoming token from the client against the specified regular expression. It will invoke the authorizer's Lambda function when there is a match. Otherwise, it will return a 401 Unauthorized response without calling the Lambda function. The validation expression does not apply to the REQUEST authorizer.

authorizer_name :: Lens' Authorizer (Maybe Text)

The name of the authorizer.

authorizer_providerARNs :: Lens' Authorizer (Maybe [Text])

A list of the Amazon Cognito user pool ARNs for the COGNITO_USER_POOLS authorizer. Each element is of this format: arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}. For a TOKEN or REQUEST authorizer, this is not defined.

authorizer_type :: Lens' Authorizer (Maybe AuthorizerType)

The authorizer type. Valid values are TOKEN for a Lambda function using a single authorization token submitted in a custom header, REQUEST for a Lambda function using incoming request parameters, and COGNITO_USER_POOLS for using an Amazon Cognito user pool.