API Gateway with CUSTOM authorizer and Usage plan at the same time?

714 Views Asked by At

I have an issue with API Gateway (REST API) which use authorizer Lambda and usage plan at the same time. The issue what I'm facing is there are two methods, lets call "A" and "B".
"A" method is using API key for protection, so you need to pass the API key in your request and if its correct you authorized to perform an operation, if not you get a "forbidden" message.
"B" method is using an authorizer Lambda for authorization and don't use API key. The problem is the following: when the authorizer Lambda denies the access for the API with the policy, the API continues the execution because its find the Usage plan and because "B" method don't use API key, it starts the execution. When I'm not passing token in the request I get the "Unauthorized" message but if the request contains for example a wrong token, the execution starts even though the authorizer Lambda denies the execution. Is there any way to resolve that conflict to keep the "A" method with API key and "B" method with custom authorization?
CloudWatch logs after an execution with a wrong token

0

There are 0 best solutions below