Skip to content

Conversation

@satyatulasijalandharch
Copy link

Creating a REST API Gateway with Amazon Verified Permissions for fine-grained authorization

This example deploys a REST API secured by Amazon Verified Permissions (AVP) and Amazon Cognito. The stack demonstrates how to combine a Cedar policy store with an API Gateway Request Authorizer so that only members of the appropriate Cognito group can invoke protected routes.


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@satyatulasijalandharch satyatulasijalandharch force-pushed the amazon-verified-permissions-rest-api branch from b6314f0 to e05d52d Compare October 10, 2025 04:14
@satyatulasijalandharch satyatulasijalandharch changed the title feat: add amazon-verified-permissions-rest-api example feat(python): add amazon-verified-permissions-rest-api example Oct 10, 2025
@satyatulasijalandharch satyatulasijalandharch force-pushed the amazon-verified-permissions-rest-api branch from e05d52d to be031b2 Compare October 17, 2025 07:52
@satyatulasijalandharch satyatulasijalandharch force-pushed the amazon-verified-permissions-rest-api branch from be031b2 to c76b806 Compare November 17, 2025 04:20
@satyatulasijalandharch satyatulasijalandharch force-pushed the amazon-verified-permissions-rest-api branch from c76b806 to 092526e Compare December 15, 2025 08:59
Copilot AI review requested due to automatic review settings December 15, 2025 08:59
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request adds a comprehensive example demonstrating how to create a REST API Gateway secured with Amazon Verified Permissions (AVP) and Amazon Cognito for fine-grained authorization using Cedar policies.

Key changes:

  • Implements a complete CDK Python stack with nested stacks for Cognito, Verified Permissions, and API Gateway
  • Provides a Node.js Lambda authorizer that integrates with AVP's isAuthorizedWithToken API
  • Includes demo Python Lambda handlers for protected endpoints
  • Adds comprehensive documentation covering architecture, deployment, and operations

Reviewed changes

Copilot reviewed 23 out of 26 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
app.py CDK application entry point
stack/main.py Root stack orchestrating nested stacks
stack/verified_permissions/ Cedar schema and policy definitions
stack/cognito/main.py Cognito user pool with admin/user groups
stack/apigw/ REST API configuration with custom authorizer
stack/lambdas/authorizer/main.js Node.js authorizer calling AVP
stack/lambdas/{user,admin}/main.py Demo business logic handlers
docs/ Architecture diagrams and implementation guides
README.md Quick start and project overview

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant