I've had a custom API built on AWS and want to secure it so that it is only accessible after completing an OAuth 2.0 web-app flow. Question is - what services within AWS are used/combined to deliver this sort of API security and Identity management/verification?

Ive not developed on AWS so totally naive as to where to start to answer such a question.

Any pointers are most appreciated!

CodePudding user response：

You could use AWS Cognito to authenticate access to AWS API Gateway:

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html

Using custom Lambda authorizer would be also an option:

https://aws.amazon.com/blogs/security/use-aws-lambda-authorizers-with-a-third-party-identity-provider-to-secure-amazon-api-gateway-rest-apis/