Skip to content

Commit 159d1c6

Browse files
carlzoghcarlzogh
authored
Merge pull request #342 from dum0nt73/master
Added struct definition to include ClientCert information to API Gateway when using mTLS
2 parents 5d64132 + bc8a460 commit 159d1c6

6 files changed

+110
-15
lines changed

‎events/apigw.go

+51-14
Original file line numberDiff line numberDiff line change
@@ -65,17 +65,18 @@ type APIGatewayV2HTTPRequest struct {
6565

6666
// APIGatewayV2HTTPRequestContext contains the information to identify the AWS account and resources invoking the Lambda function.
6767
type APIGatewayV2HTTPRequestContext struct {
68-
RouteKey string `json:"routeKey"`
69-
AccountID string `json:"accountId"`
70-
Stage string `json:"stage"`
71-
RequestID string `json:"requestId"`
72-
Authorizer *APIGatewayV2HTTPRequestContextAuthorizerDescription `json:"authorizer,omitempty"`
73-
APIID string `json:"apiId"` // The API Gateway HTTP API Id
74-
DomainName string `json:"domainName"`
75-
DomainPrefix string `json:"domainPrefix"`
76-
Time string `json:"time"`
77-
TimeEpoch int64 `json:"timeEpoch"`
78-
HTTP APIGatewayV2HTTPRequestContextHTTPDescription `json:"http"`
68+
RouteKey string `json:"routeKey"`
69+
AccountID string `json:"accountId"`
70+
Stage string `json:"stage"`
71+
RequestID string `json:"requestId"`
72+
Authorizer *APIGatewayV2HTTPRequestContextAuthorizerDescription `json:"authorizer,omitempty"`
73+
APIID string `json:"apiId"` // The API Gateway HTTP API Id
74+
DomainName string `json:"domainName"`
75+
DomainPrefix string `json:"domainPrefix"`
76+
Time string `json:"time"`
77+
TimeEpoch int64 `json:"timeEpoch"`
78+
HTTP APIGatewayV2HTTPRequestContextHTTPDescription `json:"http"`
79+
Authentication APIGatewayV2HTTPRequestContextAuthentication `json:"authentication"`
7980
}
8081

8182
// APIGatewayV2HTTPRequestContextAuthorizerDescription contains authorizer information for the request context.
@@ -189,10 +190,46 @@ type APIGatewayWebsocketProxyRequestContext struct {
189190
Status string `json:"status"`
190191
}
191192

192-
// APIGatewayCustomAuthorizerRequestTypeRequestIdentity contains identity information for the request caller.
193+
// APIGatewayCustomAuthorizerRequestTypeRequestIdentity contains identity information for the request caller including certificate information if using mTLS.
193194
type APIGatewayCustomAuthorizerRequestTypeRequestIdentity struct {
194-
APIKey string `json:"apiKey"`
195-
SourceIP string `json:"sourceIp"`
195+
APIKey string `json:"apiKey"`
196+
SourceIP string `json:"sourceIp"`
197+
ClientCert APIGatewayCustomAuthorizerRequestTypeRequestIdentityClientCert `json:"clientCert"`
198+
}
199+
200+
// APIGatewayCustomAuthorizerRequestTypeRequestIdentityClientCert contains certificate information for the request caller if using mTLS.
201+
type APIGatewayCustomAuthorizerRequestTypeRequestIdentityClientCert struct {
202+
ClientCertPem string `json:"clientCertPem"`
203+
IssuerDN string `json:"issuerDN"`
204+
SerialNumber string `json:"serialNumber"`
205+
SubjectDN string `json:"subjectDN"`
206+
Validity APIGatewayCustomAuthorizerRequestTypeRequestIdentityClientCertValidity `json:"validity"`
207+
}
208+
209+
// APIGatewayCustomAuthorizerRequestTypeRequestIdentityClientCertValidity contains certificate validity information for the request caller if using mTLS.
210+
type APIGatewayCustomAuthorizerRequestTypeRequestIdentityClientCertValidity struct {
211+
NotAfter string `json:"notAfter"`
212+
NotBefore string `json:"notBefore"`
213+
}
214+
215+
// APIGatewayV2HTTPRequestContextAuthentication contains authentication context information for the request caller including client certificate information if using mTLS.
216+
type APIGatewayV2HTTPRequestContextAuthentication struct {
217+
ClientCert APIGatewayV2HTTPRequestContextAuthenticationClientCert `json:"clientCert"`
218+
}
219+
220+
// APIGatewayV2HTTPRequestContextAuthenticationClientCert contains client certificate information for the request caller if using mTLS.
221+
type APIGatewayV2HTTPRequestContextAuthenticationClientCert struct {
222+
ClientCertPem string `json:"clientCertPem"`
223+
IssuerDN string `json:"issuerDN"`
224+
SerialNumber string `json:"serialNumber"`
225+
SubjectDN string `json:"subjectDN"`
226+
Validity APIGatewayV2HTTPRequestContextAuthenticationClientCertValidity `json:"validity"`
227+
}
228+
229+
// APIGatewayV2HTTPRequestContextAuthenticationClientCertValidity contains client certificate validity information for the request caller if using mTLS.
230+
type APIGatewayV2HTTPRequestContextAuthenticationClientCertValidity struct {
231+
NotAfter string `json:"notAfter"`
232+
NotBefore string `json:"notBefore"`
196233
}
197234

198235
// APIGatewayCustomAuthorizerContext represents the expected format of an API Gateway custom authorizer response.

‎events/testdata/apigw-custom-auth-request-type-request.json

+11-1
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,17 @@
6868
"requestId": "...",
6969
"identity": {
7070
"apiKey": "...",
71-
"sourceIp": "..."
71+
"sourceIp": "...",
72+
"clientCert": {
73+
"clientCertPem": "-----BEGIN CERTIFICATE-----\nMIIEZTCCAk0CAQEwDQ...",
74+
"issuerDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Private CA",
75+
"serialNumber": "1",
76+
"subjectDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Client",
77+
"validity": {
78+
"notAfter": "Aug 5 00:28:21 2120 GMT",
79+
"notBefore": "Aug 29 00:28:21 2020 GMT"
80+
}
81+
}
7282
},
7383
"resourcePath": "/request",
7484
"httpMethod": "GET",

‎events/testdata/apigw-v2-request-iam.json

+12
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,18 @@
3939
}
4040
},
4141
"apiId": "api-id",
42+
"authentication": {
43+
"clientCert": {
44+
"clientCertPem": "-----BEGIN CERTIFICATE-----\nMIIEZTCCAk0CAQEwDQ...",
45+
"issuerDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Private CA",
46+
"serialNumber": "1",
47+
"subjectDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Client",
48+
"validity": {
49+
"notAfter": "Aug 5 00:28:21 2120 GMT",
50+
"notBefore": "Aug 29 00:28:21 2020 GMT"
51+
}
52+
}
53+
},
4254
"domainName": "id.execute-api.us-east-1.amazonaws.com",
4355
"domainPrefix": "id",
4456
"time": "12/Mar/2020:19:03:58+0000",

‎events/testdata/apigw-v2-request-jwt-authorizer.json

+12
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,18 @@
3636
}
3737
},
3838
"apiId": "api-id",
39+
"authentication": {
40+
"clientCert": {
41+
"clientCertPem": "-----BEGIN CERTIFICATE-----\nMIIEZTCCAk0CAQEwDQ...",
42+
"issuerDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Private CA",
43+
"serialNumber": "1",
44+
"subjectDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Client",
45+
"validity": {
46+
"notAfter": "Aug 5 00:28:21 2120 GMT",
47+
"notBefore": "Aug 29 00:28:21 2020 GMT"
48+
}
49+
}
50+
},
3951
"domainName": "id.execute-api.us-east-1.amazonaws.com",
4052
"domainPrefix": "id",
4153
"time": "12/Mar/2020:19:03:58+0000",

‎events/testdata/apigw-v2-request-lambda-authorizer.json

+12
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,18 @@
2929
}
3030
},
3131
"apiId": "api-id",
32+
"authentication": {
33+
"clientCert": {
34+
"clientCertPem": "-----BEGIN CERTIFICATE-----\nMIIEZTCCAk0CAQEwDQ...",
35+
"issuerDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Private CA",
36+
"serialNumber": "1",
37+
"subjectDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Client",
38+
"validity": {
39+
"notAfter": "Aug 5 00:28:21 2120 GMT",
40+
"notBefore": "Aug 29 00:28:21 2020 GMT"
41+
}
42+
}
43+
},
3244
"domainName": "id.execute-api.us-east-1.amazonaws.com",
3345
"domainPrefix": "id",
3446
"time": "12/Mar/2020:19:03:58+0000",

‎events/testdata/apigw-v2-request-no-authorizer.json

+12
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,18 @@
1616
"requestContext": {
1717
"accountId": "123456789012",
1818
"apiId": "aaaaaaaaaa",
19+
"authentication": {
20+
"clientCert": {
21+
"clientCertPem": "-----BEGIN CERTIFICATE-----\nMIIEZTCCAk0CAQEwDQ...",
22+
"issuerDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Private CA",
23+
"serialNumber": "1",
24+
"subjectDN": "C=US,ST=Washington,L=Seattle,O=Amazon Web Services,OU=Security,CN=My Client",
25+
"validity": {
26+
"notAfter": "Aug 5 00:28:21 2120 GMT",
27+
"notBefore": "Aug 29 00:28:21 2020 GMT"
28+
}
29+
}
30+
},
1931
"domainName": "aaaaaaaaaa.execute-api.us-west-2.amazonaws.com",
2032
"domainPrefix": "aaaaaaaaaa",
2133
"http": {

0 commit comments

Comments
 (0)