blog-API-Gateway-Authorizer

code.md

(ns superapi.ions.auth
  [:require [clojure.data.json :as json]
            [datomic.ion :as ion]
            [buddy.sign.jwt :as jwt]])

(defn gateway-authorizer
  "Validate that a user's JWT signature and expiration date"
  [{:keys [input] :as ion}]
  (let [
        ; API Gateway supplies the policy resource and authorization token as input
        {:strs [authorizationToken methodArn]} (json/read-str input)
        ; Fetch the secret key from AWS Parameter Store
        secret (get (ion/get-params {:path (str "/datomic-shared/secrets/")}) "your-secret-key")
        ]
    ; Validate the JWT and extract the subject
    (when-let [sub (:sub (jwt/unsign authorizationToken secret))]
      ; Return a JSON policy to grant the user access to the API
      (json/write-str {:principalId    sub
                       :policyDocument {:Version   "2012-10-17"
                                        :Statement [
                                                    {:Effect   "Allow"
                                                     :Action   "execute-api:*"
                                                     :Resource methodArn}
                                                    ]}}))))