title: How to create a lambda permission for a custom websocket request authorizer with CloudFormation for API Gateway?
body: <p>I've been trying to create a lambda permission for a websockets request authorizer for API Gateway and the $connect route. The AWS documenation mentions nothing about creating the proper lambda permission for a websocket authorizer. I keep getting a 500 error when I try to connect to my custom authorizer. </p>
  
  <p>Since the AWS documenation (<a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-lambda-auth.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-lambda-auth.html</a>) does not mention anything about this permission, I assume one would have to create a lambda permission just like a TOKEN authorizer.</p>
  
  <p>The custom authorizer was created with my CloudFormation script as follows:</p>
  
  <pre><code># ***************************************************************
  # API Gateway Websocket Authorizer
  # ***************************************************************
  WebsocketAuthorizer:
      Type: 'AWS::ApiGatewayV2::Authorizer'
      DependsOn: Lambda
      Properties:
          Name: WebsocketAuthorizer
          ApiId:
              Fn::ImportValue:
                  !Sub ${Env}-${AWS::Region}-altosignal-global-websockets
          AuthorizerType: REQUEST
          AuthorizerCredentialsArn:
              Fn::ImportValue: 
                  !Sub ${Env}-${AWS::Region}-global-iamprocesscommandsfromapigateway-arn
          AuthorizerUri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${Lambda.Arn}/invocations
          IdentitySource: 
              - route.request.querystring.token
  </code></pre>
  
  <p>When I create an authorizer manually using the console, I get this prompt at the end:</p>
  
  <p><a href="https://i.stack.imgur.com/QyIlB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QyIlB.png" alt="enter image description here"></a></p>
  
  <p>This manually created authorizer works once I hook it up with the $connect endpoint.</p>
  
  <p>So, it is this permission I'm trying to set in my CloudFormation script. I have tried the following settings but it does not work. I keep getting a 500 error:</p>
  
  <pre><code>   LambdaPermission:
          Type: AWS::Lambda::Permission
          DependsOn: 
              - Lambda
              - WebsocketAuthorizer
          Properties:
              Action: lambda:*
              FunctionName: !GetAtt Lambda.Arn
              Principal: apigateway.amazonaws.com
              SourceArn: !Sub 
                  - arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${apiId}/${Env}/$connect
                  - apiId: 
                      Fn::ImportValue:
                          !Sub ${Env}-${AWS::Region}-altosignal-global-websockets
  </code></pre>
  
  <p>Does anybody know the proper lambda permission settings for a custom authorizer for a websocket API Gateway $connect endpoint?</p>