aws-apigw-invokes-lambda-authorizer

id: aws-apigw-invokes-lambda-authorizer
emits: CanTrigger
description: API Gateway invokes a Lambda authorizer function to evaluate access on every request (TOKEN
  or REQUEST type).
match_record:
  resource_type: AWS::ApiGateway::Authorizer
  field: authorizerUri
where:
- authorizerType in [TOKEN, REQUEST] (Lambda authorizer, not JWT/COGNITO_USER_POOLS)
- authorizerUri matches arn:aws:apigateway:<region>:lambda:path/2015-03-31/functions/<fn-arn>/invocations
emit:
  source_type: APIGateway
  target_type: ServerlessFunction
  source: <API Gateway API node that uses this authorizer>
  target: <Lambda function node from authorizerUri>
  permissions: []
  conditions:
  - trigger_exists
  - service_state
  state_logic: ACTIVE when the authorizer is attached to an API (authorizerUri is configured), enabled,
    and the Lambda resource policy grants lambda:InvokeFunction to apigateway.amazonaws.com. CONDITIONAL(trigger_exists)
    when the authorizer is defined but not yet attached to a stage/method. CONDITIONAL(resource_policy)
    when the Lambda resource policy does not yet authorize this API.
  derived_from: []
  false_positive_note: "Emit ONLY for Lambda authorizer types (authorizerType in [TOKEN, REQUEST]). Do\
    \ NOT emit for JWT or COGNITO_USER_POOLS authorizers \u2014 those are not Lambda invocations. The\
    \ authorizer Lambda is invoked on EVERY request evaluation, giving its execution role an attack surface:\
    \ any attacker-influenced request context can be sent to it. This is INDEPENDENT of the backend integration\
    \ trigger (rule 4); both can exist on the same API."
  narrative: API Gateway API {source.name} uses Lambda authorizer {target.name} to evaluate access on
    every request (TOKEN or REQUEST type); the authorizer Lambda is triggered on each evaluated request
    with attacker-influenced context (auth header or request body).