title: Custom request-based lambda authorizer for AWS API Gateway is not triggered for API innovations
body: <p>Have created a simple basic request-based authorizer for my AWS API Gateway following documentation (<a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html" rel="noreferrer">https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html</a>)</p>
  <p>While testing the Authorizer (with dummy setup which validates if Authorization header has key 'test' in it) the authorizer works fine, but while calling the API directly from the endpoint the authorizer is not called at all and I get my API response (which should be blocked as no header is passed).</p>
  <p>Authorizer test with invalid key: getting expected 401</p>
  <p><a href="https://i.stack.imgur.com/IqWVY.png" rel="noreferrer"><img src="https://i.stack.imgur.com/IqWVY.png" alt="enter image description here" /></a></p>
  <p>Authorizer test with valid key: getting expected 200</p>
  <p><a href="https://i.stack.imgur.com/lbQMz.png" rel="noreferrer"><img src="https://i.stack.imgur.com/lbQMz.png" alt="enter image description here" /></a></p>
  <p>Directly calling API endpoing from web with success:</p>
  <p><a href="https://i.stack.imgur.com/SDQIx.png" rel="noreferrer"><img src="https://i.stack.imgur.com/SDQIx.png" alt="enter image description here" /></a></p>
  <p>My resource policy for API Gateway as want to limit the innvocation from specific IP ranges only:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: &quot;*&quot;,
              &quot;Action&quot;: &quot;execute-api:Invoke&quot;,
              &quot;Resource&quot;: &quot;arn:aws:execute-api:us-east-1:111111111111:6mm9kw17uf/*/*/*&quot;
          },
          {
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Principal&quot;: &quot;*&quot;,
              &quot;Action&quot;: &quot;execute-api:Invoke&quot;,
              &quot;Resource&quot;: &quot;arn:aws:execute-api:us-east-1:111111111111:6mm9kw17uf/*/*/*&quot;,
              &quot;Condition&quot;: {
                  &quot;NotIpAddress&quot;: {
                      &quot;aws:SourceIp&quot;: &quot;XXXXXXX&quot;
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>Authorizer Lambda Code:</p>
  <pre><code>exports.handler = function(event, context, callback) {        
      console.log('Received event:', JSON.stringify(event, null, 2));
  
      // Retrieve request parameters from the Lambda function input:
      var headers = event.headers;
          
      // Parse the input for the parameter values
      var tmp = event.methodArn.split(':');
      var apiGatewayArnTmp = tmp[5].split('/');
      var awsAccountId = tmp[4];
      var region = tmp[3];
      var restApiId = apiGatewayArnTmp[0];
      var stage = apiGatewayArnTmp[1];
      var method = apiGatewayArnTmp[2];
      var resource = '/'; // root resource
      if (apiGatewayArnTmp[3]) {
          resource += apiGatewayArnTmp[3];
      }
          
      // Perform authorization to return the Allow policy for correct parameters and 
      // the 'Unauthorized' error, otherwise.
      var authResponse = {};
      var condition = {};
      condition.IpAddress = {};
       
      if (headers.Authorization === &quot;test&quot;) {
          callback(null, generateAllow('me', event.methodArn));
      }  else {
          callback(&quot;Unauthorized&quot;);
      }
  }
       
  // Help function to generate an IAM policy
  var generatePolicy = function(principalId, effect, resource) {
      // Required output:
      var authResponse = {};
      authResponse.principalId = principalId;
      if (effect &amp;&amp; resource) {
          var policyDocument = {};
          policyDocument.Version = '2012-10-17';
          policyDocument.Statement = [];
          var statementOne = {};
          statementOne.Action = 'execute-api:Invoke';
          statementOne.Effect = effect;
          statementOne.Resource = resource;
          policyDocument.Statement[0] = statementOne;
          authResponse.policyDocument = policyDocument;
      }
      return authResponse;
  }
       
  var generateAllow = function(principalId, resource) {
      return generatePolicy(principalId, 'Allow', resource);
  }
       
  var generateDeny = function(principalId, resource) {
      return generatePolicy(principalId, 'Deny', resource);
  }
  </code></pre>
  <p>What I have tried already:</p>
  <ol>
  <li>I already re-deployed the APIs again after adding the authorizer.</li>
  <li>I am testing this from postman and web browser, not Gateway test as it will bypass authorizer.</li>
  </ol>