# Ensure API Gateway has configured authorizers

- Source: https://support.icompaas.com/support/solutions/articles/62000127114-ensure-api-gateway-has-configured-authorizers
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-06-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

In AWS Authorizers is known as a Lambda authorizer (formerly known as a custom authorizer) is an API Gateway feature that uses a Lambda function to control access to your API. Authorizers use a Lambda function. 

When you interface with API Gateway publicly accessible endpoints, it is done through public networks. When they’re configured as private, the public networks are not made available to route your API. Instead, your API can only be accessed using the interface endpoints that you have configured.

There are two types of Lambda authorizers:

1.  Token-based: A token-based Lambda authorizer (also called a TOKEN authorizer) receives the caller’s identity in a bearer token, such as a JSON Web Token (JWT) or an OAuth token.
    
2.  Request parameter-based: A request parameter-based Lambda authorizer (also called a REQUEST authorizer) receives the caller’s identity as a combination of headers, query string parameters, state variables, and $context variables.
    

Note: For WebSocket APIs, only request parameter-based authorizers are supported.

  

Rationale:

It is recommended that the API Gateway endpoint should not be publicly accessible to other services resources in AWS. Public API Gateway endpoint means that unauthorized actors could access your data which can lead to misuse of the data.

As an API authorizer function, you can also use the AWS Lambda function from a different AWS account. Each account can be in any region where Amazon API Gateway is available.

  

Impact:

Due to this policy API Gateway controls access to your API.

It helps for every unique client can be cached to avoid multiple requests.

Its logic will be independent of the rest of the codebase. This layer is used for the incoming request to validate.

  

Default Value:

By default in API Gateway, no Authorizer created or configure.

  

Pre-Requisite:

Before configuring a Lambda authorizer, you must first create the Lambda function that implements the logic to authorize and if necessary authenticate the caller.

The Lambda console provides a Python blueprint, which you can use by choosing Use a blueprint and choosing the API-gateway-authorizer-python blueprint. 

  

Remediation:

Test Plan:

1.  Sign in AWS Management Console
    
2.  Go to API Gateway dashboard at [console.aws.amazon.com/apigateway](http://console.aws.amazon.com/apigateway)
    
3.  Click on API Name to audit
    
4.  Click on Resources
    
5.  Click on Method here in our API Method is “Get”  
    
6.   In the Method Execution under the Method Request it contains Auth (Authorization)  
      
    If it is set to none it means it is not enabled or not configured Lambda authorizers  
    To check Lambda Authorizers configure or not 
    
7.  Click on Authorizers below the stage in the left navigation pane  
    
8.   In the Authorizers dashboard if no authorizer is found it means you do not configure or create an authorizer
    

  

Using AWS CLI:

To get the list of authorizers for a REST API

aws apigateway get-authorizers --rest-api-id <rest\_api\_id>

  

Remediation:

Implementation Steps:

1.  Log in to AWS Management Console
    
2.  Go to Lambda service at [https://console.aws.amazon.com/lambda/](https://console.aws.amazon.com/lambda/)
    

  

3.  Click on Functions in the left navigation pane
    
4.  Click on create a function to create a lambda function 
    

5.   Fill in the Basic information and select the Runtime as per your requirement here we select Python 3.7
    

6.  Click on Create function button
    
7.  After creating the function configure the code, go to the code source and configure the code as per your requirement below given example is the source code to configure the lambda function  
      
    
    def lambda\_handler(event, context):  
          
        #1 - Log the event  
        print('\*\*\*\*\*\*\*\*\*\* The event is: \*\*\*\*\*\*\*\*\*\*')  
        print(event)  
          
            #2 - See if the person's token is valid  
        auth = 'Deny'  
        if event\['authorizationToken'\] == 'abc123':  
            auth = 'Allow'  
        else:  
            autho = 'Deny'  
              
        #3 - Construct and return the response  
        authResponse = { "principalId": "abc123", "policyDocument": {  "Version": "2012-10-17", "Statement": \[{"Action": "execute-api:Invoke", "Resource": \["arn:aws:execute-api:<region>:<youraccountnumber>:ksixrqez26/\*/\*"\], "Effect": auth}\] }}
    
      
    
8.  After the configuration, you click on the deploy button
    

  
        

9.  After the configuration of the Lambda function in the source code go to the API Gateway dashboard
    
10.  Navigate to API Gateway at [console.aws.amazon.com/apigateway](http://console.aws.amazon.com/apigateway)
     
11.  Click on the API name you want and click on Authorizers in the left navigation pane
     

12.  Click on Create New Authorizer button
     

13.  Give the name of Authorizer and select the lambda function which you create for the authorization and give the name of Token source and by default Authorization, Caching is Enabled here we uncheck it  
     
14.  Click on Create button
     
15.  In Add Permission to Lambda Function click on Grant & Create button
     

  
        Now Authorizer has been created 

-   Click on the Test button to test it 
    

  

-   Give the right authorization token you get “Effect”: “Allow”
    

  
after the test, you confirm that your authorizer is working

16.   Go to resources in the left navigation pane  
     
17.  Click on Get Method in the Resources
     
18.  In the Method Execution click on Method Request
     

19.  In the settings Click on the Authorization edit button  
     

  

Backout Plan:

Step 1: Sign in AWS Management Console

Step 2: Go to API Gateway dashboard at [console.aws.amazon.com/apigateway](http://console.aws.amazon.com/apigateway)

Step 3: Click on API Name 

Step 4: Click on Resources and click on Method

Step 5: In Method Execution click on Method Request

Step 6: Click on the Edit button in Authorization and select None and click on the update button

Step 7: Go to Authorizer and click on the delete authorizer button to remove the authorizer  

  

Using AWS CLI:

To delete a Custom Authorizer in an API

aws apigateway delete-authorizer --rest-api-id <api\_id> --authorizer-id <give\_authorizer\_id>

  

Reference:

-   [Use API Gateway Lambda authorizers - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html) 
    
-   [Configure a cross-account Lambda authorizer - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-lambda-authorizer-cross-account-lambda-authorizer.html) 
    
-   [get-authorizers — AWS CLI 1.20.6 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-authorizers.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.