ngx-lua validating requests from AWS API Gateway with client certificate

nginx.conf

server {
    listen 443 ssl;
    server_name gw.pahud.net;

    ssl_certificate       /opt/openresty/nginx/conf/ssl/chained.crt;
    ssl_certificate_key   /opt/openresty/nginx/conf/ssl/private-key.pem;
    ssl_client_certificate   /opt/openresty/nginx/conf/ssl/apigw.crt;
    ssl_verify_client optional;

    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    add_header Strict-Transport-Security max-age=63072000;
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";

    default_type "text/plain;charset=UTF-8";

	location = /client-certificate-info {
		content_by_lua_block {
			local ssl_client_i_dn = ngx.var.ssl_client_i_dn or ''
			local ssl_client_s_dn = ngx.var.ssl_client_s_dn or ''
			local buf = 'ssl_client_i_dn='..ssl_client_i_dn..'\n'
			buf = buf..'ssl_client_s_dn='..ssl_client_s_dn..'\n'
			buf = buf..'ssl_client_verify='..ngx.var.ssl_client_verify..'\n'
			ngx.header['Content-Length'] = #buf
			ngx.print(buf)
		}
	}


    location = /ec2/instance-id/require-valid-client-certificate {
		# handle the validation by yourself in rewrite phase if 'ssl_verify_client optional'
        rewrite_by_lua_block {
                if ngx.var.ssl_client_verify~='SUCCESS' then
                        local buf = 'No required SSL certificate was sent\n'
                        ngx.header['Content-Length'] = #buf
                        ngx.status = ngx.HTTP_FORBIDDEN
                        ngx.print(buf)
                        ngx.exit(ngx.status)
                end
        }
        proxy_pass http://169.254.169.254/latest/meta-data/instance-id;
    }



	location = /ec2/instance-id {
		proxy_pass http://169.254.169.254/latest/meta-data/instance-id;
	}
	location = /ec2/az {
		proxy_pass http://169.254.169.254/latest/meta-data/placement/availability-zone;
	}


	location = /time { content_by_lua_block { ngx.say( ngx.time() ) } }

	location = /http_time { content_by_lua_block { ngx.say( ngx.http_time(ngx.now()) ) } }

	location = /cookie_time { content_by_lua_block { ngx.say( ngx.cookie_time(ngx.now()) ) } }

	location = /utctime { content_by_lua_block { ngx.say( ngx.utctime() ) } }

	location = /now { content_by_lua_block { ngx.say( ngx.now() ) } }

}