How can I authenticate AWS Lambda without an API Gateway?

Question

I've got an iOS Shopping App and want to send crash dumps to an AWS Lambda Function.

To save costs for an API Gateway I want to send them directly to Lambda.

How can I authenticate the App and configure it so no other App can send crash dumps to my Lambda Function?

• Pyae Phyoe Shein: lambda function cannot be exposed endpoint url. you better integrate with api gateway.
• Dr. Marc: I had the idea to use the Mobile SDK for iOS AWS integration and wanted to send the crash dumps to the Lambda function ARN. So you think this would not be possible? @PyaePhyoeShein
• Pyae Phyoe Shein: Could you try aws cognito with lambda?
• Dr. Marc: This would be a great idea! I read something about it, but what I did not understand was if our customers have to an extra authentication or if its all in the background? Because an extra authentication step would not be accepted by the customers. @PyaePhyoeShein
• Pyae Phyoe Shein: Pls don't forgot to mark my answer as correct one after you fixed it. Thanks.

Answer 1

1. AWS Cognito https://aws.amazon.com/cognito/
2. Manually develop all the auth code. OAuth 2.0 with JWT tokens for example. In that case your Lambda can be executed by anyone (Bad idea), still you can limit concurrent executions.

Answer 2

I'll tell you what i have do for a similar problem:

• create an AWS user for the app, so the app has access to AWS_SECRET_KEY_ID and AWS_SECRET_ACCESS_KEY
• In the app, (for safety) encrypt a crafted json with aws credentials using a KMS key for example
• Invoke the lambda function with the encrypted payload as parameter, decrypt the payload and get user identity as following:

session = boto3.Session(
 aws_access_key_id=session['access_key'],
 aws_secret_access_key=session['secret_access_key'],
 aws_session_token=session['security_token']
 )
client = session.client('sts')
response = client.get_caller_identity()

• Axwack: This seems insecure. What is the design pattern when your code resides, say on PREMISES, but you are accessing the AWS from a data center? Do you have to create a server and put this in the user profile as the user?