title: How to connect lambda authorizer to a gateway api? Verifying user in cognito userpool?
body: <p>Here is my aws template file:</p>
  <pre><code>AWSTemplateFormatVersion: '2010-09-09'
  Transform: AWS::Serverless-2016-10-31
  Description: &gt;
  
  Globals:
    Function:
      Timeout: 3
  
  Resources:
    MyApi:
      Type: AWS::Serverless::Api
      Properties:
        StageName: Prod
        Auth:
          DefaultAuthorizer: MyLambdaTokenAuthorizer
          Authorizers:
            MyLambdaTokenAuthorizer:
              FunctionArn: !GetAtt MyAuthFunction.Arn
  
    MyFunction:
      Type: AWS::Serverless::Function
      Properties:
        CodeUri: my_folder/
        Handler: hello.handler
        Runtime: python3.9
        Events:
          GetRoot:
            Type: Api
            Properties:
              RestApiId: !Ref MyApi
              Path: /
              Method: get
  
    MyAuthFunction:
      Type: AWS::Serverless::Function
      Properties:
        CodeUri: my_folder/
        Handler: authorizer.handler
        Runtime: python3.9
  </code></pre>
  <p>The problem I have is the api as it currently stands is open to anyone to use it, so I want to control access to the api so that someone must signup and login before using the api.</p>
  <p>Reading tutorials online on how to create an authorizer I've found this:</p>
  <ol>
  <li>A client will make a request to the API.</li>
  <li>The API Gateway will determine if a custom authorizer is configured and will invoke it.</li>
  <li>The custom authorizer will then determine if the token is valid and generate a policy.</li>
  <li>The API Gateway will check the policy and will either “allow” or “deny” your request to the API.</li>
  </ol>
  <p>Another part of this code I set up a cogito userpool/client. The user can signup, then once they successfully log-in this generates a JWT.</p>
  <p>I currently dont have any code inside of my_folder/authorizer.handler. I also dont understand what the policy document is, I keep coming across the term but haven't seen it formally defined yet in terms of authorizations.</p>
  <p>What I basically want to know is, when a user logs in and generates a JWT how do I verify it each time a user hits an api endpoint?</p>
  <p>I imagine it would work like:</p>
  <p>user logs in -&gt; JWT generates -&gt; client tries to access api endpoint (using Postman) -&gt; &quot;Unauthorized&quot; is shown -&gt; User uses the JWT for authorizer -&gt; the authorizer intercepts this and verifies the user.</p>
  <p>So every time a user goes to a different endpoint on my system the JWT is checked to verify the user is who they say they are.</p>
  <p>I also want to confirm the user is in the cognito userpool. When I decoded the JWT using jwt.io it shows the user info such as username/password. Is there a way to add a second layer to authentication where the user info is checked against what is in the userpool?</p>