title: How can I use permissions generated in AWS Custom Authorizer in my lambda code?
body: <p>I'd like to generate a custom policy that provides <a href="https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/specifying-conditions.html" rel="nofollow noreferrer">fine grained access</a> to DynamoDB tables inside an AWS custom authorizer.  Is this possible?</p>
  
  <p>In serverless, my configuration looks like this:</p>
  
  <pre><code>functions:
    APIAuthorizer:
      handler: src/services/auth/handlers.apiAuthorizer
      cors: true
    GraphQLAPI:
      handler: src/services/graphql/handlers.apiHandler
      events:
        - http:
            path: "/api"
            method: post
            cors: true
            authorizer:
              name: APIAuthorizer
              type: request
              resultTtlInSeconds: 0
  </code></pre>
  
  <p>I've verified that my custom authorizer is being called, and that various  permissions it generates (<code>sts:AssumeRole</code>, <code>lambda:InvokeFunction</code>, <code>execute-api:Invoke</code>, and others) are required for successfully invoking the API handler.  So my custom authorizer is working and the result it provides is necessary.</p>
  
  <p>However, when the authorizer includes dynamodb permissions, e.g., a statement like
      { Effect: "Allow", Action: "dynamodb:<em>", "Resource": "</em>" }</p>
  
  <p>my API handler (the GraphQLAPI function) fails with a message like </p>
  
  <pre><code>User: arn:aws:sts::&lt;myaccountid&gt;:assumed-role/&lt;mydefaultrole&gt;/myservice-mystage-GraphQLAPI is not authorized to perform: dynamodb:Query on resource: arn:aws:dynamodb:us-east-1:&lt;myaccountId&gt;:table/&lt;mytable&gt;/index/&lt;someIndex&gt; 
  </code></pre>
  
  <p>(I noticed the complaint is about an index permission, so also tried adding specific permissions for that index and/or for all indexes, but this has no effect.)</p>
  
  <p>The bottom line, after many different attempts, is that dynamodb permissions issued by the custom authorizer are completely ignored. My lambda node.js code is using the AWS node SDK, which should be picking up permissions from the instance environment. I assumed this would include permissions generated by the custom authorizer.</p>
  
  <p>Finally, I noticed that the <a href="https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/loading-node-credentials-lambda.html" rel="nofollow noreferrer">AWS javascript SDK documentation on how credentials are loaded</a> says only  "The execution role provides the Lambda function with the credentials it needs to run and to invoke other web services". I.e., it doesn't mention the dynamically generated credentials issued by the custom authorizer.</p>
  
  <p>This seems to explain the behavior I'm seeing. My API handler only has permissions from the statically defined execution role (the error message indicates that too), and isn't granted permissions generated by the custom authorizer. </p>
  
  <p>Is there anyway to use the permissions my custom authorizer generates inside my API handler?</p>