authorizers

Creates, updates, deletes, gets or lists an authorizers resource.

Overview

Name	authorizers
Type	Resource
Id	aws.iot.authorizers

Fields

The following fields are returned by SELECT queries:

describe_authorizer

Name	Datatype	Description
authorizer_arn	string	The authorizer ARN.
authorizer_function_arn	string	The authorizer's Lambda function ARN. (pattern: <code>[\s\S]*</code>)
authorizer_name	string	The authorizer name. (pattern: <code>[\w=,@-]+</code>)
creation_date	string (date-time)	The UNIX timestamp of when the authorizer was created.
enable_caching_for_http	boolean	When true, the result from the authorizer’s Lambda function is cached for the time specified in refreshAfterInSeconds. The cached result is used while the device reuses the same HTTP connection.
last_modified_date	string (date-time)	The UNIX timestamp of when the authorizer was last updated.
signing_disabled	boolean	Specifies whether IoT validates the token signature in an authorization request.
status	string	The status of the authorizer. (ACTIVE, INACTIVE)
token_key_name	string	The key used to extract the token from the HTTP headers. (pattern: <code>[a-zA-Z0-9_-]+</code>)
token_signing_public_keys	object	The public keys used to validate the token signature returned by your custom authentication service.

list_authorizers

Name	Datatype	Description
authorizer_arn	string	The authorizer ARN.
authorizer_name	string	The authorizer name. (pattern: <code>[\w=,@-]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_authorizer	select	authorizer_name, region		Describes an authorizer. Requires permission to access the DescribeAuthorizer action.
list_authorizers	select	region	pageSize, marker, isAscendingOrder, status	Lists the authorizers registered in your account. Requires permission to access the ListAuthorizers action.
create_authorizer	insert	authorizer_name, region, authorizerFunctionArn		Creates an authorizer. Requires permission to access the CreateAuthorizer action.
update_authorizer	update	authorizer_name, region		Updates an authorizer. Requires permission to access the UpdateAuthorizer action.
delete_authorizer	delete	authorizer_name, region		Deletes an authorizer. Requires permission to access the DeleteAuthorizer action.
test_invoke_authorizer	exec	authorizer_name, region		Tests a custom authorization behavior by invoking a specified custom authorizer. Use this to test and debug the custom authorization behavior of devices that connect to the IoT device gateway. Requires permission to access the TestInvokeAuthorizer action.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
authorizer_name	string	The custom authorizer name.
region	string	AWS region (default: us-east-1)
isAscendingOrder	boolean	Return the list of authorizers in ascending alphabetical order.
marker	string	A marker used to get the next set of results.
pageSize	integer	The maximum number of results to return at one time.
status	string	The status of the list authorizers request.

SELECT examples

describe_authorizer

Describes an authorizer. Requires permission to access the DescribeAuthorizer action.

SELECT
authorizer_arn,
authorizer_function_arn,
authorizer_name,
creation_date,
enable_caching_for_http,
last_modified_date,
signing_disabled,
status,
token_key_name,
token_signing_public_keys
FROM aws.iot.authorizers
WHERE authorizer_name = '{{ authorizer_name }}' -- required
AND region = '{{ region }}' -- required
;

list_authorizers

Lists the authorizers registered in your account. Requires permission to access the ListAuthorizers action.

SELECT
authorizer_arn,
authorizer_name
FROM aws.iot.authorizers
WHERE region = '{{ region }}' -- required
AND pageSize = '{{ pageSize }}'
AND marker = '{{ marker }}'
AND isAscendingOrder = '{{ isAscendingOrder }}'
AND status = '{{ status }}'
;

INSERT examples

create_authorizer

Creates an authorizer. Requires permission to access the CreateAuthorizer action.

INSERT INTO aws.iot.authorizers (
authorizerFunctionArn,
tokenKeyName,
tokenSigningPublicKeys,
status,
tags,
signingDisabled,
enableCachingForHttp,
authorizer_name,
region
)
SELECT 
'{{ authorizerFunctionArn }}' /* required */,
'{{ tokenKeyName }}',
'{{ tokenSigningPublicKeys }}',
'{{ status }}',
'{{ tags }}',
{{ signingDisabled }},
{{ enableCachingForHttp }},
'{{ authorizer_name }}',
'{{ region }}'
RETURNING
authorizer_arn,
authorizer_name
;

Manifest

# Description fields are for documentation purposes
- name: authorizers
props:
  - name: authorizer_name
    value: "{{ authorizer_name }}"
    description: Required parameter for the authorizers resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the authorizers resource.
  - name: authorizerFunctionArn
    value: "{{ authorizerFunctionArn }}"
  - name: tokenKeyName
    value: "{{ tokenKeyName }}"
  - name: tokenSigningPublicKeys
    value: "{{ tokenSigningPublicKeys }}"
  - name: status
    value: "{{ status }}"
    valid_values: ['ACTIVE', 'INACTIVE']
  - name: tags
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"
  - name: signingDisabled
    value: {{ signingDisabled }}
  - name: enableCachingForHttp
    value: {{ enableCachingForHttp }}

UPDATE examples

update_authorizer

Updates an authorizer. Requires permission to access the UpdateAuthorizer action.

UPDATE aws.iot.authorizers
SET 
authorizerFunctionArn = '{{ authorizerFunctionArn }}',
tokenKeyName = '{{ tokenKeyName }}',
tokenSigningPublicKeys = '{{ tokenSigningPublicKeys }}',
status = '{{ status }}',
enableCachingForHttp = {{ enableCachingForHttp }}
WHERE 
authorizer_name = '{{ authorizer_name }}' --required
AND region = '{{ region }}' --required
RETURNING
authorizer_arn,
authorizer_name;

DELETE examples

delete_authorizer

Deletes an authorizer. Requires permission to access the DeleteAuthorizer action.

DELETE FROM aws.iot.authorizers
WHERE authorizer_name = '{{ authorizer_name }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

test_invoke_authorizer

Tests a custom authorization behavior by invoking a specified custom authorizer. Use this to test and debug the custom authorization behavior of devices that connect to the IoT device gateway. Requires permission to access the TestInvokeAuthorizer action.

EXEC aws.iot.authorizers.test_invoke_authorizer 
@authorizer_name='{{ authorizer_name }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"token": "{{ token }}", 
"tokenSignature": "{{ tokenSignature }}", 
"httpContext": "{{ httpContext }}", 
"mqttContext": "{{ mqttContext }}", 
"tlsContext": "{{ tlsContext }}"
}'
;