# CDK Lambda TokenAuthorizer JWT
Add a lambda function to your project which can be used as a apigateway token authorizer
[](https://constructs.dev/packages/@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt)
[](https://github.com/cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt/blob/main/LICENSE)
[](https://github.com/cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt/releases)
[](https://www.npmjs.com/package/@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt)
[](https://pypi.org/project/cloudy-with-a-chance-of-meatballs.cdk-lambda-token-authorizer-jwt/)
[](https://www.nuget.org/packages/CloudyWithAchanceOfMeatballs.CdkLambdaTokenAuthorizerJwt/)
[](https://github.com/cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt/actions/workflows/release.yml)
[](https://codeclimate.com/github/cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt/maintainability)
[](https://codecov.io/gh/cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt)
[](https://gitpod.io/#https://github.com/cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt)
## Install
### TypeScript
```shell
npm install @cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt
```
### Python
```shell
pip install cloudy-with-a-chance-of-meatballs.cdk-lambda-token-authorizer-jwt
```
## Usage
### Notes
- **JWT Token handling**: The token verfification is done via [https://github.com/auth0/node-jsonwebtoken](https://github.com/auth0/node-jsonwebtoken), the jwks fetcher is using [https://github.com/auth0/node-jwks-rsa](https://github.com/auth0/node-jwks-rsa). The implementation per default verifies the token and if given the expiration.
- **JWT Payload:** Any verification of the token payload must be done over injecting a json schema for validation using [https://ajv.js.org/json-type-definition.html](https://ajv.js.org/json-type-definition.html).
- **Protocols:** [main/API.md#iauthorizeroptions](https://github.com/cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt/blob/main/API.md#iauthorizeroptions-)
### Example usage with Rest Apigateway
```typescript
import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';
export class HelloworldStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
const api = new apigateway.RestApi(this, 'ApiName', {});
const tokenAuthFunction = new TokenAuthorizerJwtFunction(this, 'fnName', {
tokenAuthorizerOptions: {
verificationStrategy: {
strategyName: 'argument',
secret: 'mySecret-symmetric-or-asymmetric',
},
},
});
const tokenAuthorizer = new apigateway.TokenAuthorizer(this, 'fnNameApiGwAuthorizer', {
handler: tokenAuthFunction // use the TokenAuthorizerJwtFunction
});
const dummyFn = new lambda.Function(this, 'helloWorldFunction', {
handler: 'index.handler',
code: lambda.Code.fromInline(`exports.handler = async (event) => { console.log('event: ', event); return '{"statusCode": 200, "message": "DummyLambdaFunction"}' };`),
runtime: lambda.Runtime.NODEJS_16_X,
});
const dummyLambdaIntegration = new apigateway.LambdaIntegration(
dummyFn, { passthroughBehavior: apigateway.PassthroughBehavior.WHEN_NO_MATCH }
);
const someMethod = api.root.addMethod("GET", dummyLambdaIntegration, {
authorizer: tokenAuthorizer
});
}
}
```
### Validation
```typescript
import * as cdk from 'aws-cdk-lib';
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';
const app = new cdk.App();
const stack = new cdk.Stack(app, 'MyStack');
const myValidation = { properties:{ iss: { enum: ['my_trusted_iss'] } }};
new TokenAuthorizerJwtFunction(stack, 'example-stack', {
tokenAuthorizerOptions: {
payloadValidationStrategy: {
strategyName: 'schema',
schema: JSON.stringify(myValidation)
},
verificationStrategy: { strategyName: 'argument', secret: 'someSecret' }
}
});
```
### Using JWKS
```typescript
import * as cdk from 'aws-cdk-lib';
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';
const app = new cdk.App();
const stack = new cdk.Stack(app, 'MyStack');
new TokenAuthorizerJwtFunction(stack, 'example-stack', {
tokenAuthorizerOptions: {
verificationStrategy: {
strategyName: 'jwksFromUriByKid',
uri: 'uri',
kid: 'kid',
}
}
});
```
### Using asymmetric algorithms, e.g. public key
```typescript
import * as cdk from 'aws-cdk-lib';
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';
const app = new cdk.App();
const stack = new cdk.Stack(app, 'MyStack');
const myPublicKeyOneliner = '-----BEGIN PUBLIC KEY---\nMFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKuTfz7kpJHPrmcmgx4Xf4GMoM2kK4mh\nMpSOW3qu1zZA1wfMHV8PS0Kds0nXMB6mmHk/Ke1\Et68aEspQRIn1aLcCAwEAAQ==\n-----END PUBLIC KEY-----';
new TokenAuthorizerJwtFunction(stack, 'example-stack', {
tokenAuthorizerOptions: {
verificationStrategy: {
strategyName: 'argument',
secret: myPublicKeyOneliner
}
}
});
```
### Using symmetric algorithms, same key for sign and verify :warning:
**Attention:** the key might be exposed during deploy, in the runtime etc.
```typescript
import * as cdk from 'aws-cdk-lib';
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt';
const app = new cdk.App();
const stack = new cdk.Stack(app, 'MyStack');
const mySymmetricSecret = 'sharedSecret';
new TokenAuthorizerJwtFunction(stack, 'example-stack', {
tokenAuthorizerOptions: {
verificationStrategy: {
strategyName: 'argument',
secret: mySymmetricSecret
}
}
});
```
🍻
# API Reference
## Constructs
### TokenAuthorizerJwtFunction
#### Initializers
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
new TokenAuthorizerJwtFunction(scope: Construct, id: string, props: TokenAuthorizerFunctionOptions)
```
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| scope | constructs.Construct | *No description.* |
| id | string | *No description.* |
| props | TokenAuthorizerFunctionOptions | *No description.* |
---
##### `scope`Required
- *Type:* constructs.Construct
---
##### `id`Required
- *Type:* string
---
##### `props`Required
- *Type:* TokenAuthorizerFunctionOptions
---
#### Methods
| **Name** | **Description** |
| --- | --- |
| toString | Returns a string representation of this construct. |
| applyRemovalPolicy | Apply the given removal policy to this resource. |
| addEventSource | Adds an event source to this function. |
| addEventSourceMapping | Adds an event source that maps to this AWS Lambda function. |
| addFunctionUrl | Adds a url to this lambda function. |
| addPermission | Adds a permission to the Lambda resource policy. |
| addToRolePolicy | Adds a statement to the IAM role assumed by the instance. |
| configureAsyncInvoke | Configures options for asynchronous invocation. |
| considerWarningOnInvokeFunctionPermissions | A warning will be added to functions under the following conditions: - permissions that include `lambda:InvokeFunction` are added to the unqualified function. |
| grantInvoke | Grant the given identity permissions to invoke this Lambda. |
| grantInvokeCompositePrincipal | Grant multiple principals the ability to invoke this Lambda via CompositePrincipal. |
| grantInvokeUrl | Grant the given identity permissions to invoke this Lambda Function URL. |
| metric | Return the given named metric for this Function. |
| metricDuration | How long execution of this Lambda takes. |
| metricErrors | How many invocations of this Lambda fail. |
| metricInvocations | How often this Lambda is invoked. |
| metricThrottles | How often this Lambda is throttled. |
| addAlias | Defines an alias for this function. |
| addEnvironment | Adds an environment variable to this Lambda function. |
| addLayers | Adds one or more Lambda Layers to this Lambda function. |
| invalidateVersionBasedOn | Mix additional information into the hash of the Version object. |
---
##### `toString`
```typescript
public toString(): string
```
Returns a string representation of this construct.
##### `applyRemovalPolicy`
```typescript
public applyRemovalPolicy(policy: RemovalPolicy): void
```
Apply the given removal policy to this resource.
The Removal Policy controls what happens to this resource when it stops
being managed by CloudFormation, either because you've removed it from the
CDK application or because you've made a change that requires the resource
to be replaced.
The resource can be deleted (`RemovalPolicy.DESTROY`), or left in your AWS
account for data recovery and cleanup later (`RemovalPolicy.RETAIN`).
###### `policy`Required
- *Type:* aws-cdk-lib.RemovalPolicy
---
##### `addEventSource`
```typescript
public addEventSource(source: IEventSource): void
```
Adds an event source to this function.
Event sources are implemented in the aws-cdk-lib/aws-lambda-event-sources module.
The following example adds an SQS Queue as an event source:
```
import { SqsEventSource } from 'aws-cdk-lib/aws-lambda-event-sources';
myFunction.addEventSource(new SqsEventSource(myQueue));
```
###### `source`Required
- *Type:* aws-cdk-lib.aws_lambda.IEventSource
---
##### `addEventSourceMapping`
```typescript
public addEventSourceMapping(id: string, options: EventSourceMappingOptions): EventSourceMapping
```
Adds an event source that maps to this AWS Lambda function.
###### `id`Required
- *Type:* string
---
###### `options`Required
- *Type:* aws-cdk-lib.aws_lambda.EventSourceMappingOptions
---
##### `addFunctionUrl`
```typescript
public addFunctionUrl(options?: FunctionUrlOptions): FunctionUrl
```
Adds a url to this lambda function.
###### `options`Optional
- *Type:* aws-cdk-lib.aws_lambda.FunctionUrlOptions
---
##### `addPermission`
```typescript
public addPermission(id: string, permission: Permission): void
```
Adds a permission to the Lambda resource policy.
> [Permission for details.](Permission for details.)
###### `id`Required
- *Type:* string
The id for the permission construct.
---
###### `permission`Required
- *Type:* aws-cdk-lib.aws_lambda.Permission
The permission to grant to this Lambda function.
---
##### `addToRolePolicy`
```typescript
public addToRolePolicy(statement: PolicyStatement): void
```
Adds a statement to the IAM role assumed by the instance.
###### `statement`Required
- *Type:* aws-cdk-lib.aws_iam.PolicyStatement
---
##### `configureAsyncInvoke`
```typescript
public configureAsyncInvoke(options: EventInvokeConfigOptions): void
```
Configures options for asynchronous invocation.
###### `options`Required
- *Type:* aws-cdk-lib.aws_lambda.EventInvokeConfigOptions
---
##### `considerWarningOnInvokeFunctionPermissions`
```typescript
public considerWarningOnInvokeFunctionPermissions(scope: Construct, action: string): void
```
A warning will be added to functions under the following conditions: - permissions that include `lambda:InvokeFunction` are added to the unqualified function.
function.currentVersion is invoked before or after the permission is created.
This applies only to permissions on Lambda functions, not versions or aliases.
This function is overridden as a noOp for QualifiedFunctionBase.
###### `scope`Required
- *Type:* constructs.Construct
---
###### `action`Required
- *Type:* string
---
##### `grantInvoke`
```typescript
public grantInvoke(grantee: IGrantable): Grant
```
Grant the given identity permissions to invoke this Lambda.
###### `grantee`Required
- *Type:* aws-cdk-lib.aws_iam.IGrantable
---
##### `grantInvokeCompositePrincipal`
```typescript
public grantInvokeCompositePrincipal(compositePrincipal: CompositePrincipal): Grant[]
```
Grant multiple principals the ability to invoke this Lambda via CompositePrincipal.
###### `compositePrincipal`Required
- *Type:* aws-cdk-lib.aws_iam.CompositePrincipal
---
##### `grantInvokeUrl`
```typescript
public grantInvokeUrl(grantee: IGrantable): Grant
```
Grant the given identity permissions to invoke this Lambda Function URL.
###### `grantee`Required
- *Type:* aws-cdk-lib.aws_iam.IGrantable
---
##### `metric`
```typescript
public metric(metricName: string, props?: MetricOptions): Metric
```
Return the given named metric for this Function.
###### `metricName`Required
- *Type:* string
---
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricDuration`
```typescript
public metricDuration(props?: MetricOptions): Metric
```
How long execution of this Lambda takes.
Average over 5 minutes
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricErrors`
```typescript
public metricErrors(props?: MetricOptions): Metric
```
How many invocations of this Lambda fail.
Sum over 5 minutes
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricInvocations`
```typescript
public metricInvocations(props?: MetricOptions): Metric
```
How often this Lambda is invoked.
Sum over 5 minutes
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricThrottles`
```typescript
public metricThrottles(props?: MetricOptions): Metric
```
How often this Lambda is throttled.
Sum over 5 minutes
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `addAlias`
```typescript
public addAlias(aliasName: string, options?: AliasOptions): Alias
```
Defines an alias for this function.
The alias will automatically be updated to point to the latest version of
the function as it is being updated during a deployment.
```ts
declare const fn: lambda.Function;
fn.addAlias('Live');
// Is equivalent to
new lambda.Alias(this, 'AliasLive', {
aliasName: 'Live',
version: fn.currentVersion,
});
```
###### `aliasName`Required
- *Type:* string
The name of the alias.
---
###### `options`Optional
- *Type:* aws-cdk-lib.aws_lambda.AliasOptions
Alias options.
---
##### `addEnvironment`
```typescript
public addEnvironment(key: string, value: string, options?: EnvironmentOptions): Function
```
Adds an environment variable to this Lambda function.
If this is a ref to a Lambda function, this operation results in a no-op.
###### `key`Required
- *Type:* string
The environment variable key.
---
###### `value`Required
- *Type:* string
The environment variable's value.
---
###### `options`Optional
- *Type:* aws-cdk-lib.aws_lambda.EnvironmentOptions
Environment variable options.
---
##### `addLayers`
```typescript
public addLayers(layers: ILayerVersion): void
```
Adds one or more Lambda Layers to this Lambda function.
###### `layers`Required
- *Type:* aws-cdk-lib.aws_lambda.ILayerVersion
the layers to be added.
---
##### `invalidateVersionBasedOn`
```typescript
public invalidateVersionBasedOn(x: string): void
```
Mix additional information into the hash of the Version object.
The Lambda Function construct does its best to automatically create a new
Version when anything about the Function changes (its code, its layers,
any of the other properties).
However, you can sometimes source information from places that the CDK cannot
look into, like the deploy-time values of SSM parameters. In those cases,
the CDK would not force the creation of a new Version object when it actually
should.
This method can be used to invalidate the current Version object. Pass in
any string into this method, and make sure the string changes when you know
a new Version needs to be created.
This method may be called more than once.
###### `x`Required
- *Type:* string
---
#### Static Functions
| **Name** | **Description** |
| --- | --- |
| isConstruct | Checks if `x` is a construct. |
| isOwnedResource | Returns true if the construct was created by CDK, and false otherwise. |
| isResource | Check whether the given construct is a Resource. |
| classifyVersionProperty | Record whether specific properties in the `AWS::Lambda::Function` resource should also be associated to the Version resource. |
| fromFunctionArn | Import a lambda function into the CDK using its ARN. |
| fromFunctionAttributes | Creates a Lambda function object which represents a function not defined within this stack. |
| fromFunctionName | Import a lambda function into the CDK using its name. |
| metricAll | Return the given named metric for this Lambda. |
| metricAllConcurrentExecutions | Metric for the number of concurrent executions across all Lambdas. |
| metricAllDuration | Metric for the Duration executing all Lambdas. |
| metricAllErrors | Metric for the number of Errors executing all Lambdas. |
| metricAllInvocations | Metric for the number of invocations of all Lambdas. |
| metricAllThrottles | Metric for the number of throttled invocations of all Lambdas. |
| metricAllUnreservedConcurrentExecutions | Metric for the number of unreserved concurrent executions across all Lambdas. |
---
##### `isConstruct`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.isConstruct(x: any)
```
Checks if `x` is a construct.
Use this method instead of `instanceof` to properly detect `Construct`
instances, even when the construct library is symlinked.
Explanation: in JavaScript, multiple copies of the `constructs` library on
disk are seen as independent, completely different libraries. As a
consequence, the class `Construct` in each copy of the `constructs` library
is seen as a different class, and an instance of one class will not test as
`instanceof` the other class. `npm install` will not create installations
like this, but users may manually symlink construct libraries together or
use a monorepo tool: in those cases, multiple copies of the `constructs`
library can be accidentally installed, and `instanceof` will behave
unpredictably. It is safest to avoid using `instanceof`, and using
this type-testing method instead.
###### `x`Required
- *Type:* any
Any object.
---
##### `isOwnedResource`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.isOwnedResource(construct: IConstruct)
```
Returns true if the construct was created by CDK, and false otherwise.
###### `construct`Required
- *Type:* constructs.IConstruct
---
##### `isResource`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.isResource(construct: IConstruct)
```
Check whether the given construct is a Resource.
###### `construct`Required
- *Type:* constructs.IConstruct
---
##### `classifyVersionProperty`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.classifyVersionProperty(propertyName: string, locked: boolean)
```
Record whether specific properties in the `AWS::Lambda::Function` resource should also be associated to the Version resource.
See 'currentVersion' section in the module README for more details.
###### `propertyName`Required
- *Type:* string
The property to classify.
---
###### `locked`Required
- *Type:* boolean
whether the property should be associated to the version or not.
---
##### `fromFunctionArn`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.fromFunctionArn(scope: Construct, id: string, functionArn: string)
```
Import a lambda function into the CDK using its ARN.
For `Function.addPermissions()` to work on this imported lambda, make sure that is
in the same account and region as the stack you are importing it into.
###### `scope`Required
- *Type:* constructs.Construct
---
###### `id`Required
- *Type:* string
---
###### `functionArn`Required
- *Type:* string
---
##### `fromFunctionAttributes`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.fromFunctionAttributes(scope: Construct, id: string, attrs: FunctionAttributes)
```
Creates a Lambda function object which represents a function not defined within this stack.
For `Function.addPermissions()` to work on this imported lambda, set the sameEnvironment property to true
if this imported lambda is in the same account and region as the stack you are importing it into.
###### `scope`Required
- *Type:* constructs.Construct
The parent construct.
---
###### `id`Required
- *Type:* string
The name of the lambda construct.
---
###### `attrs`Required
- *Type:* aws-cdk-lib.aws_lambda.FunctionAttributes
the attributes of the function to import.
---
##### `fromFunctionName`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.fromFunctionName(scope: Construct, id: string, functionName: string)
```
Import a lambda function into the CDK using its name.
###### `scope`Required
- *Type:* constructs.Construct
---
###### `id`Required
- *Type:* string
---
###### `functionName`Required
- *Type:* string
---
##### `metricAll`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.metricAll(metricName: string, props?: MetricOptions)
```
Return the given named metric for this Lambda.
###### `metricName`Required
- *Type:* string
---
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricAllConcurrentExecutions`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.metricAllConcurrentExecutions(props?: MetricOptions)
```
Metric for the number of concurrent executions across all Lambdas.
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricAllDuration`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.metricAllDuration(props?: MetricOptions)
```
Metric for the Duration executing all Lambdas.
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricAllErrors`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.metricAllErrors(props?: MetricOptions)
```
Metric for the number of Errors executing all Lambdas.
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricAllInvocations`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.metricAllInvocations(props?: MetricOptions)
```
Metric for the number of invocations of all Lambdas.
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricAllThrottles`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.metricAllThrottles(props?: MetricOptions)
```
Metric for the number of throttled invocations of all Lambdas.
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
##### `metricAllUnreservedConcurrentExecutions`
```typescript
import { TokenAuthorizerJwtFunction } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
TokenAuthorizerJwtFunction.metricAllUnreservedConcurrentExecutions(props?: MetricOptions)
```
Metric for the number of unreserved concurrent executions across all Lambdas.
###### `props`Optional
- *Type:* aws-cdk-lib.aws_cloudwatch.MetricOptions
---
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| node | constructs.Node | The tree node. |
| env | aws-cdk-lib.ResourceEnvironment | The environment this resource belongs to. |
| stack | aws-cdk-lib.Stack | The stack in which this resource is defined. |
| architecture | aws-cdk-lib.aws_lambda.Architecture | The architecture of this Lambda Function (this is an optional attribute and defaults to X86_64). |
| connections | aws-cdk-lib.aws_ec2.Connections | Access the Connections object. |
| functionArn | string | ARN of this function. |
| functionName | string | Name of this function. |
| grantPrincipal | aws-cdk-lib.aws_iam.IPrincipal | The principal this Lambda Function is running as. |
| isBoundToVpc | boolean | Whether or not this Lambda function was bound to a VPC. |
| latestVersion | aws-cdk-lib.aws_lambda.IVersion | The `$LATEST` version of this function. |
| permissionsNode | constructs.Node | The construct node where permissions are attached. |
| resourceArnsForGrantInvoke | string[] | The ARN(s) to put into the resource field of the generated IAM policy for grantInvoke(). |
| role | aws-cdk-lib.aws_iam.IRole | Execution role associated with this function. |
| currentVersion | aws-cdk-lib.aws_lambda.Version | Returns a `lambda.Version` which represents the current version of this Lambda function. A new version will be created every time the function's configuration changes. |
| logGroup | aws-cdk-lib.aws_logs.ILogGroup | The LogGroup where the Lambda function's logs are made available. |
| runtime | aws-cdk-lib.aws_lambda.Runtime | The runtime configured for this lambda. |
| deadLetterQueue | aws-cdk-lib.aws_sqs.IQueue | The DLQ (as queue) associated with this Lambda Function (this is an optional attribute). |
| deadLetterTopic | aws-cdk-lib.aws_sns.ITopic | The DLQ (as topic) associated with this Lambda Function (this is an optional attribute). |
| timeout | aws-cdk-lib.Duration | The timeout configured for this lambda. |
---
##### `node`Required
```typescript
public readonly node: Node;
```
- *Type:* constructs.Node
The tree node.
---
##### `env`Required
```typescript
public readonly env: ResourceEnvironment;
```
- *Type:* aws-cdk-lib.ResourceEnvironment
The environment this resource belongs to.
For resources that are created and managed by the CDK
(generally, those created by creating new class instances like Role, Bucket, etc.),
this is always the same as the environment of the stack they belong to;
however, for imported resources
(those obtained from static methods like fromRoleArn, fromBucketName, etc.),
that might be different than the stack they were imported into.
---
##### `stack`Required
```typescript
public readonly stack: Stack;
```
- *Type:* aws-cdk-lib.Stack
The stack in which this resource is defined.
---
##### `architecture`Required
```typescript
public readonly architecture: Architecture;
```
- *Type:* aws-cdk-lib.aws_lambda.Architecture
The architecture of this Lambda Function (this is an optional attribute and defaults to X86_64).
---
##### `connections`Required
```typescript
public readonly connections: Connections;
```
- *Type:* aws-cdk-lib.aws_ec2.Connections
Access the Connections object.
Will fail if not a VPC-enabled Lambda Function
---
##### `functionArn`Required
```typescript
public readonly functionArn: string;
```
- *Type:* string
ARN of this function.
---
##### `functionName`Required
```typescript
public readonly functionName: string;
```
- *Type:* string
Name of this function.
---
##### `grantPrincipal`Required
```typescript
public readonly grantPrincipal: IPrincipal;
```
- *Type:* aws-cdk-lib.aws_iam.IPrincipal
The principal this Lambda Function is running as.
---
##### `isBoundToVpc`Required
```typescript
public readonly isBoundToVpc: boolean;
```
- *Type:* boolean
Whether or not this Lambda function was bound to a VPC.
If this is is `false`, trying to access the `connections` object will fail.
---
##### `latestVersion`Required
```typescript
public readonly latestVersion: IVersion;
```
- *Type:* aws-cdk-lib.aws_lambda.IVersion
The `$LATEST` version of this function.
Note that this is reference to a non-specific AWS Lambda version, which
means the function this version refers to can return different results in
different invocations.
To obtain a reference to an explicit version which references the current
function configuration, use `lambdaFunction.currentVersion` instead.
---
##### `permissionsNode`Required
```typescript
public readonly permissionsNode: Node;
```
- *Type:* constructs.Node
The construct node where permissions are attached.
---
##### `resourceArnsForGrantInvoke`Required
```typescript
public readonly resourceArnsForGrantInvoke: string[];
```
- *Type:* string[]
The ARN(s) to put into the resource field of the generated IAM policy for grantInvoke().
---
##### `role`Optional
```typescript
public readonly role: IRole;
```
- *Type:* aws-cdk-lib.aws_iam.IRole
Execution role associated with this function.
---
##### `currentVersion`Required
```typescript
public readonly currentVersion: Version;
```
- *Type:* aws-cdk-lib.aws_lambda.Version
Returns a `lambda.Version` which represents the current version of this Lambda function. A new version will be created every time the function's configuration changes.
You can specify options for this version using the `currentVersionOptions`
prop when initializing the `lambda.Function`.
---
##### `logGroup`Required
```typescript
public readonly logGroup: ILogGroup;
```
- *Type:* aws-cdk-lib.aws_logs.ILogGroup
The LogGroup where the Lambda function's logs are made available.
If either `logRetention` is set or this property is called, a CloudFormation custom resource is added to the stack that
pre-creates the log group as part of the stack deployment, if it already doesn't exist, and sets the correct log retention
period (never expire, by default).
Further, if the log group already exists and the `logRetention` is not set, the custom resource will reset the log retention
to never expire even if it was configured with a different value.
---
##### `runtime`Required
```typescript
public readonly runtime: Runtime;
```
- *Type:* aws-cdk-lib.aws_lambda.Runtime
The runtime configured for this lambda.
---
##### `deadLetterQueue`Optional
```typescript
public readonly deadLetterQueue: IQueue;
```
- *Type:* aws-cdk-lib.aws_sqs.IQueue
The DLQ (as queue) associated with this Lambda Function (this is an optional attribute).
---
##### `deadLetterTopic`Optional
```typescript
public readonly deadLetterTopic: ITopic;
```
- *Type:* aws-cdk-lib.aws_sns.ITopic
The DLQ (as topic) associated with this Lambda Function (this is an optional attribute).
---
##### `timeout`Optional
```typescript
public readonly timeout: Duration;
```
- *Type:* aws-cdk-lib.Duration
The timeout configured for this lambda.
---
## Structs
### TokenAuthorizerFunctionOptions
#### Initializer
```typescript
import { TokenAuthorizerFunctionOptions } from '@cloudy-with-a-chance-of-meatballs/cdk-lambda-token-authorizer-jwt'
const tokenAuthorizerFunctionOptions: TokenAuthorizerFunctionOptions = { ... }
```
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| maxEventAge | aws-cdk-lib.Duration | The maximum age of a request that Lambda sends to a function for processing. |
| onFailure | aws-cdk-lib.aws_lambda.IDestination | The destination for failed invocations. |
| onSuccess | aws-cdk-lib.aws_lambda.IDestination | The destination for successful invocations. |
| retryAttempts | number | The maximum number of times to retry when the function returns an error. |
| adotInstrumentation | aws-cdk-lib.aws_lambda.AdotInstrumentationConfig | Specify the configuration of AWS Distro for OpenTelemetry (ADOT) instrumentation. |
| allowAllOutbound | boolean | Whether to allow the Lambda to send all network traffic. |
| allowPublicSubnet | boolean | Lambda Functions in a public subnet can NOT access the internet. |
| applicationLogLevel | string | Sets the application log level for the function. |
| applicationLogLevelV2 | aws-cdk-lib.aws_lambda.ApplicationLogLevel | Sets the application log level for the function. |
| architecture | aws-cdk-lib.aws_lambda.Architecture | The system architectures compatible with this lambda function. |
| codeSigningConfig | aws-cdk-lib.aws_lambda.ICodeSigningConfig | Code signing config associated with this function. |
| currentVersionOptions | aws-cdk-lib.aws_lambda.VersionOptions | Options for the `lambda.Version` resource automatically created by the `fn.currentVersion` method. |
| deadLetterQueue | aws-cdk-lib.aws_sqs.IQueue | The SQS queue to use if DLQ is enabled. |
| deadLetterQueueEnabled | boolean | Enabled DLQ. |
| deadLetterTopic | aws-cdk-lib.aws_sns.ITopic | The SNS topic to use as a DLQ. |
| description | string | A description of the function. |
| environment | {[ key: string ]: string} | Key-value pairs that Lambda caches and makes available for your Lambda functions. |
| environmentEncryption | aws-cdk-lib.aws_kms.IKey | The AWS KMS key that's used to encrypt your function's environment variables. |
| ephemeralStorageSize | aws-cdk-lib.Size | The size of the function’s /tmp directory in MiB. |
| events | aws-cdk-lib.aws_lambda.IEventSource[] | Event sources for this function. |
| filesystem | aws-cdk-lib.aws_lambda.FileSystem | The filesystem configuration for the lambda function. |
| functionName | string | A name for the function. |
| initialPolicy | aws-cdk-lib.aws_iam.PolicyStatement[] | Initial policy statements to add to the created Lambda Role. |
| insightsVersion | aws-cdk-lib.aws_lambda.LambdaInsightsVersion | Specify the version of CloudWatch Lambda insights to use for monitoring. |
| ipv6AllowedForDualStack | boolean | Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets. |
| layers | aws-cdk-lib.aws_lambda.ILayerVersion[] | A list of layers to add to the function's execution environment. |
| logFormat | string | Sets the logFormat for the function. |
| loggingFormat | aws-cdk-lib.aws_lambda.LoggingFormat | Sets the loggingFormat for the function. |
| logGroup | aws-cdk-lib.aws_logs.ILogGroup | The log group the function sends logs to. |
| logRetention | aws-cdk-lib.aws_logs.RetentionDays | The number of days log events are kept in CloudWatch Logs. |
| logRetentionRetryOptions | aws-cdk-lib.aws_lambda.LogRetentionRetryOptions | When log retention is specified, a custom resource attempts to create the CloudWatch log group. |
| logRetentionRole | aws-cdk-lib.aws_iam.IRole | The IAM role for the Lambda function associated with the custom resource that sets the retention policy. |
| memorySize | number | The amount of memory, in MB, that is allocated to your Lambda function. |
| paramsAndSecrets | aws-cdk-lib.aws_lambda.ParamsAndSecretsLayerVersion | Specify the configuration of Parameters and Secrets Extension. |
| profiling | boolean | Enable profiling. |
| profilingGroup | aws-cdk-lib.aws_codeguruprofiler.IProfilingGroup | Profiling Group. |
| reservedConcurrentExecutions | number | The maximum of concurrent executions you want to reserve for the function. |
| role | aws-cdk-lib.aws_iam.IRole | Lambda execution role. |
| runtimeManagementMode | aws-cdk-lib.aws_lambda.RuntimeManagementMode | Sets the runtime management configuration for a function's version. |
| securityGroups | aws-cdk-lib.aws_ec2.ISecurityGroup[] | The list of security groups to associate with the Lambda's network interfaces. |
| snapStart | aws-cdk-lib.aws_lambda.SnapStartConf | Enable SnapStart for Lambda Function. |
| systemLogLevel | string | Sets the system log level for the function. |
| systemLogLevelV2 | aws-cdk-lib.aws_lambda.SystemLogLevel | Sets the system log level for the function. |
| timeout | aws-cdk-lib.Duration | The function execution time (in seconds) after which Lambda terminates the function. |
| tracing | aws-cdk-lib.aws_lambda.Tracing | Enable AWS X-Ray Tracing for Lambda Function. |
| vpc | aws-cdk-lib.aws_ec2.IVpc | VPC network to place Lambda network interfaces. |
| vpcSubnets | aws-cdk-lib.aws_ec2.SubnetSelection | Where to place the network interfaces within the VPC. |
| tokenAuthorizerOptions | ITokenAuthorizerOptions | *No description.* |
---
##### `maxEventAge`Optional
```typescript
public readonly maxEventAge: Duration;
```
- *Type:* aws-cdk-lib.Duration
- *Default:* Duration.hours(6)
The maximum age of a request that Lambda sends to a function for processing.
Minimum: 60 seconds
Maximum: 6 hours
---
##### `onFailure`Optional
```typescript
public readonly onFailure: IDestination;
```
- *Type:* aws-cdk-lib.aws_lambda.IDestination
- *Default:* no destination
The destination for failed invocations.
---
##### `onSuccess`Optional
```typescript
public readonly onSuccess: IDestination;
```
- *Type:* aws-cdk-lib.aws_lambda.IDestination
- *Default:* no destination
The destination for successful invocations.
---
##### `retryAttempts`Optional
```typescript
public readonly retryAttempts: number;
```
- *Type:* number
- *Default:* 2
The maximum number of times to retry when the function returns an error.
Minimum: 0
Maximum: 2
---
##### `adotInstrumentation`Optional
```typescript
public readonly adotInstrumentation: AdotInstrumentationConfig;
```
- *Type:* aws-cdk-lib.aws_lambda.AdotInstrumentationConfig
- *Default:* No ADOT instrumentation
Specify the configuration of AWS Distro for OpenTelemetry (ADOT) instrumentation.
> [https://aws-otel.github.io/docs/getting-started/lambda](https://aws-otel.github.io/docs/getting-started/lambda)
---
##### `allowAllOutbound`Optional
```typescript
public readonly allowAllOutbound: boolean;
```
- *Type:* boolean
- *Default:* true
Whether to allow the Lambda to send all network traffic.
If set to false, you must individually add traffic rules to allow the
Lambda to connect to network targets.
Do not specify this property if the `securityGroups` or `securityGroup` property is set.
Instead, configure `allowAllOutbound` directly on the security group.
---
##### `allowPublicSubnet`Optional
```typescript
public readonly allowPublicSubnet: boolean;
```
- *Type:* boolean
- *Default:* false
Lambda Functions in a public subnet can NOT access the internet.
Use this property to acknowledge this limitation and still place the function in a public subnet.
> [https://stackoverflow.com/questions/52992085/why-cant-an-aws-lambda-function-inside-a-public-subnet-in-a-vpc-connect-to-the/52994841#52994841](https://stackoverflow.com/questions/52992085/why-cant-an-aws-lambda-function-inside-a-public-subnet-in-a-vpc-connect-to-the/52994841#52994841)
---
##### ~~`applicationLogLevel`~~Optional
- *Deprecated:* Use `applicationLogLevelV2` as a property instead.
```typescript
public readonly applicationLogLevel: string;
```
- *Type:* string
- *Default:* "INFO"
Sets the application log level for the function.
---
##### `applicationLogLevelV2`Optional
```typescript
public readonly applicationLogLevelV2: ApplicationLogLevel;
```
- *Type:* aws-cdk-lib.aws_lambda.ApplicationLogLevel
- *Default:* ApplicationLogLevel.INFO
Sets the application log level for the function.
---
##### `architecture`Optional
```typescript
public readonly architecture: Architecture;
```
- *Type:* aws-cdk-lib.aws_lambda.Architecture
- *Default:* Architecture.X86_64
The system architectures compatible with this lambda function.
---
##### `codeSigningConfig`Optional
```typescript
public readonly codeSigningConfig: ICodeSigningConfig;
```
- *Type:* aws-cdk-lib.aws_lambda.ICodeSigningConfig
- *Default:* Not Sign the Code
Code signing config associated with this function.
---
##### `currentVersionOptions`Optional
```typescript
public readonly currentVersionOptions: VersionOptions;
```
- *Type:* aws-cdk-lib.aws_lambda.VersionOptions
- *Default:* default options as described in `VersionOptions`
Options for the `lambda.Version` resource automatically created by the `fn.currentVersion` method.
---
##### `deadLetterQueue`Optional
```typescript
public readonly deadLetterQueue: IQueue;
```
- *Type:* aws-cdk-lib.aws_sqs.IQueue
- *Default:* SQS queue with 14 day retention period if `deadLetterQueueEnabled` is `true`
The SQS queue to use if DLQ is enabled.
If SNS topic is desired, specify `deadLetterTopic` property instead.
---
##### `deadLetterQueueEnabled`Optional
```typescript
public readonly deadLetterQueueEnabled: boolean;
```
- *Type:* boolean
- *Default:* false unless `deadLetterQueue` is set, which implies DLQ is enabled.
Enabled DLQ.
If `deadLetterQueue` is undefined,
an SQS queue with default options will be defined for your Function.
---
##### `deadLetterTopic`Optional
```typescript
public readonly deadLetterTopic: ITopic;
```
- *Type:* aws-cdk-lib.aws_sns.ITopic
- *Default:* no SNS topic
The SNS topic to use as a DLQ.
Note that if `deadLetterQueueEnabled` is set to `true`, an SQS queue will be created
rather than an SNS topic. Using an SNS topic as a DLQ requires this property to be set explicitly.
---
##### `description`Optional
```typescript
public readonly description: string;
```
- *Type:* string
- *Default:* No description.
A description of the function.
---
##### `environment`Optional
```typescript
public readonly environment: {[ key: string ]: string};
```
- *Type:* {[ key: string ]: string}
- *Default:* No environment variables.
Key-value pairs that Lambda caches and makes available for your Lambda functions.
Use environment variables to apply configuration changes, such
as test and production environment configurations, without changing your
Lambda function source code.
---
##### `environmentEncryption`Optional
```typescript
public readonly environmentEncryption: IKey;
```
- *Type:* aws-cdk-lib.aws_kms.IKey
- *Default:* AWS Lambda creates and uses an AWS managed customer master key (CMK).
The AWS KMS key that's used to encrypt your function's environment variables.
---
##### `ephemeralStorageSize`Optional
```typescript
public readonly ephemeralStorageSize: Size;
```
- *Type:* aws-cdk-lib.Size
- *Default:* 512 MiB
The size of the function’s /tmp directory in MiB.
---
##### `events`Optional
```typescript
public readonly events: IEventSource[];
```
- *Type:* aws-cdk-lib.aws_lambda.IEventSource[]
- *Default:* No event sources.
Event sources for this function.
You can also add event sources using `addEventSource`.
---
##### `filesystem`Optional
```typescript
public readonly filesystem: FileSystem;
```
- *Type:* aws-cdk-lib.aws_lambda.FileSystem
- *Default:* will not mount any filesystem
The filesystem configuration for the lambda function.
---
##### `functionName`Optional
```typescript
public readonly functionName: string;
```
- *Type:* string
- *Default:* AWS CloudFormation generates a unique physical ID and uses that ID for the function's name. For more information, see Name Type.
A name for the function.
---
##### `initialPolicy`Optional
```typescript
public readonly initialPolicy: PolicyStatement[];
```
- *Type:* aws-cdk-lib.aws_iam.PolicyStatement[]
- *Default:* No policy statements are added to the created Lambda role.
Initial policy statements to add to the created Lambda Role.
You can call `addToRolePolicy` to the created lambda to add statements post creation.
---
##### `insightsVersion`Optional
```typescript
public readonly insightsVersion: LambdaInsightsVersion;
```
- *Type:* aws-cdk-lib.aws_lambda.LambdaInsightsVersion
- *Default:* No Lambda Insights
Specify the version of CloudWatch Lambda insights to use for monitoring.
> [https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Lambda-Insights-Getting-Started-docker.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Lambda-Insights-Getting-Started-docker.html)
---
##### `ipv6AllowedForDualStack`Optional
```typescript
public readonly ipv6AllowedForDualStack: boolean;
```
- *Type:* boolean
- *Default:* false
Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets.
Only used if 'vpc' is supplied.
---
##### `layers`Optional
```typescript
public readonly layers: ILayerVersion[];
```
- *Type:* aws-cdk-lib.aws_lambda.ILayerVersion[]
- *Default:* No layers.
A list of layers to add to the function's execution environment.
You can configure your Lambda function to pull in
additional code during initialization in the form of layers. Layers are packages of libraries or other dependencies
that can be used by multiple functions.
---
##### ~~`logFormat`~~Optional
- *Deprecated:* Use `loggingFormat` as a property instead.
```typescript
public readonly logFormat: string;
```
- *Type:* string
- *Default:* "Text"
Sets the logFormat for the function.
---
##### `loggingFormat`Optional
```typescript
public readonly loggingFormat: LoggingFormat;
```
- *Type:* aws-cdk-lib.aws_lambda.LoggingFormat
- *Default:* LoggingFormat.TEXT
Sets the loggingFormat for the function.
---
##### `logGroup`Optional
```typescript
public readonly logGroup: ILogGroup;
```
- *Type:* aws-cdk-lib.aws_logs.ILogGroup
- *Default:* `/aws/lambda/${this.functionName}` - default log group created by Lambda
The log group the function sends logs to.
By default, Lambda functions send logs to an automatically created default log group named /aws/lambda/\.
However you cannot change the properties of this auto-created log group using the AWS CDK, e.g. you cannot set a different log retention.
Use the `logGroup` property to create a fully customizable LogGroup ahead of time, and instruct the Lambda function to send logs to it.
Providing a user-controlled log group was rolled out to commercial regions on 2023-11-16.
If you are deploying to another type of region, please check regional availability first.
---
##### `logRetention`Optional
```typescript
public readonly logRetention: RetentionDays;
```
- *Type:* aws-cdk-lib.aws_logs.RetentionDays
- *Default:* logs.RetentionDays.INFINITE
The number of days log events are kept in CloudWatch Logs.
When updating
this property, unsetting it doesn't remove the log retention policy. To
remove the retention policy, set the value to `INFINITE`.
This is a legacy API and we strongly recommend you move away from it if you can.
Instead create a fully customizable log group with `logs.LogGroup` and use the `logGroup` property
to instruct the Lambda function to send logs to it.
Migrating from `logRetention` to `logGroup` will cause the name of the log group to change.
Users and code and referencing the name verbatim will have to adjust.
In AWS CDK code, you can access the log group name directly from the LogGroup construct:
```ts
import * as logs from 'aws-cdk-lib/aws-logs';
declare const myLogGroup: logs.LogGroup;
myLogGroup.logGroupName;
```
---
##### `logRetentionRetryOptions`Optional
```typescript
public readonly logRetentionRetryOptions: LogRetentionRetryOptions;
```
- *Type:* aws-cdk-lib.aws_lambda.LogRetentionRetryOptions
- *Default:* Default AWS SDK retry options.
When log retention is specified, a custom resource attempts to create the CloudWatch log group.
These options control the retry policy when interacting with CloudWatch APIs.
This is a legacy API and we strongly recommend you migrate to `logGroup` if you can.
`logGroup` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it.
---
##### `logRetentionRole`Optional
```typescript
public readonly logRetentionRole: IRole;
```
- *Type:* aws-cdk-lib.aws_iam.IRole
- *Default:* A new role is created.
The IAM role for the Lambda function associated with the custom resource that sets the retention policy.
This is a legacy API and we strongly recommend you migrate to `logGroup` if you can.
`logGroup` allows you to create a fully customizable log group and instruct the Lambda function to send logs to it.
---
##### `memorySize`Optional
```typescript
public readonly memorySize: number;
```
- *Type:* number
- *Default:* 128
The amount of memory, in MB, that is allocated to your Lambda function.
Lambda uses this value to proportionally allocate the amount of CPU
power. For more information, see Resource Model in the AWS Lambda
Developer Guide.
---
##### `paramsAndSecrets`Optional
```typescript
public readonly paramsAndSecrets: ParamsAndSecretsLayerVersion;
```
- *Type:* aws-cdk-lib.aws_lambda.ParamsAndSecretsLayerVersion
- *Default:* No Parameters and Secrets Extension
Specify the configuration of Parameters and Secrets Extension.
> [https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.html](https://docs.aws.amazon.com/systems-manager/latest/userguide/ps-integration-lambda-extensions.html)
---
##### `profiling`Optional
```typescript
public readonly profiling: boolean;
```
- *Type:* boolean
- *Default:* No profiling.
Enable profiling.
> [https://docs.aws.amazon.com/codeguru/latest/profiler-ug/setting-up-lambda.html](https://docs.aws.amazon.com/codeguru/latest/profiler-ug/setting-up-lambda.html)
---
##### `profilingGroup`Optional
```typescript
public readonly profilingGroup: IProfilingGroup;
```
- *Type:* aws-cdk-lib.aws_codeguruprofiler.IProfilingGroup
- *Default:* A new profiling group will be created if `profiling` is set.
Profiling Group.
> [https://docs.aws.amazon.com/codeguru/latest/profiler-ug/setting-up-lambda.html](https://docs.aws.amazon.com/codeguru/latest/profiler-ug/setting-up-lambda.html)
---
##### `reservedConcurrentExecutions`Optional
```typescript
public readonly reservedConcurrentExecutions: number;
```
- *Type:* number
- *Default:* No specific limit - account limit.
The maximum of concurrent executions you want to reserve for the function.
> [https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html](https://docs.aws.amazon.com/lambda/latest/dg/concurrent-executions.html)
---
##### `role`Optional
```typescript
public readonly role: IRole;
```
- *Type:* aws-cdk-lib.aws_iam.IRole
- *Default:* A unique role will be generated for this lambda function. Both supplied and generated roles can always be changed by calling `addToRolePolicy`.
Lambda execution role.
This is the role that will be assumed by the function upon execution.
It controls the permissions that the function will have. The Role must
be assumable by the 'lambda.amazonaws.com' service principal.
The default Role automatically has permissions granted for Lambda execution. If you
provide a Role, you must add the relevant AWS managed policies yourself.
The relevant managed policies are "service-role/AWSLambdaBasicExecutionRole" and
"service-role/AWSLambdaVPCAccessExecutionRole".
---
##### `runtimeManagementMode`Optional
```typescript
public readonly runtimeManagementMode: RuntimeManagementMode;
```
- *Type:* aws-cdk-lib.aws_lambda.RuntimeManagementMode
- *Default:* Auto
Sets the runtime management configuration for a function's version.
---
##### `securityGroups`Optional
```typescript
public readonly securityGroups: ISecurityGroup[];
```
- *Type:* aws-cdk-lib.aws_ec2.ISecurityGroup[]
- *Default:* If the function is placed within a VPC and a security group is not specified, either by this or securityGroup prop, a dedicated security group will be created for this function.
The list of security groups to associate with the Lambda's network interfaces.
Only used if 'vpc' is supplied.
---
##### `snapStart`Optional
```typescript
public readonly snapStart: SnapStartConf;
```
- *Type:* aws-cdk-lib.aws_lambda.SnapStartConf
- *Default:* No snapstart
Enable SnapStart for Lambda Function.
SnapStart is currently supported only for Java 11, 17 runtime
---
##### ~~`systemLogLevel`~~Optional
- *Deprecated:* Use `systemLogLevelV2` as a property instead.
```typescript
public readonly systemLogLevel: string;
```
- *Type:* string
- *Default:* "INFO"
Sets the system log level for the function.
---
##### `systemLogLevelV2`Optional
```typescript
public readonly systemLogLevelV2: SystemLogLevel;
```
- *Type:* aws-cdk-lib.aws_lambda.SystemLogLevel
- *Default:* SystemLogLevel.INFO
Sets the system log level for the function.
---
##### `timeout`Optional
```typescript
public readonly timeout: Duration;
```
- *Type:* aws-cdk-lib.Duration
- *Default:* Duration.seconds(3)
The function execution time (in seconds) after which Lambda terminates the function.
Because the execution time affects cost, set this value
based on the function's expected execution time.
---
##### `tracing`Optional
```typescript
public readonly tracing: Tracing;
```
- *Type:* aws-cdk-lib.aws_lambda.Tracing
- *Default:* Tracing.Disabled
Enable AWS X-Ray Tracing for Lambda Function.
---
##### `vpc`Optional
```typescript
public readonly vpc: IVpc;
```
- *Type:* aws-cdk-lib.aws_ec2.IVpc
- *Default:* Function is not placed within a VPC.
VPC network to place Lambda network interfaces.
Specify this if the Lambda function needs to access resources in a VPC.
This is required when `vpcSubnets` is specified.
---
##### `vpcSubnets`Optional
```typescript
public readonly vpcSubnets: SubnetSelection;
```
- *Type:* aws-cdk-lib.aws_ec2.SubnetSelection
- *Default:* the Vpc default strategy if not specified
Where to place the network interfaces within the VPC.
This requires `vpc` to be specified in order for interfaces to actually be
placed in the subnets. If `vpc` is not specify, this will raise an error.
Note: Internet access for Lambda Functions requires a NAT Gateway, so picking
public subnets is not allowed (unless `allowPublicSubnet` is set to `true`).
---
##### `tokenAuthorizerOptions`Required
```typescript
public readonly tokenAuthorizerOptions: ITokenAuthorizerOptions;
```
- *Type:* ITokenAuthorizerOptions
---
## Protocols
### ITokenAuthorizerOptions
- *Implemented By:* ITokenAuthorizerOptions
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| verificationStrategy | ITokenVerificationStrategyArgument \| ITokenVerificationStrategyJwksFromUriByKid | *No description.* |
| payloadValidationStrategy | ITokenValidationStrategyAjvJsonSchemaValidator | *No description.* |
---
##### `verificationStrategy`Required
```typescript
public readonly verificationStrategy: ITokenVerificationStrategyArgument | ITokenVerificationStrategyJwksFromUriByKid;
```
- *Type:* ITokenVerificationStrategyArgument | ITokenVerificationStrategyJwksFromUriByKid
---
##### `payloadValidationStrategy`Optional
```typescript
public readonly payloadValidationStrategy: ITokenValidationStrategyAjvJsonSchemaValidator;
```
- *Type:* ITokenValidationStrategyAjvJsonSchemaValidator
---
### ITokenValidationStrategyAjvJsonSchemaValidator
- *Implemented By:* ITokenValidationStrategyAjvJsonSchemaValidator
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| schema | string | *No description.* |
| strategyName | string | *No description.* |
---
##### `schema`Required
```typescript
public readonly schema: string;
```
- *Type:* string
---
##### `strategyName`Required
```typescript
public readonly strategyName: string;
```
- *Type:* string
---
### ITokenVerificationStrategyArgument
- *Implemented By:* ITokenVerificationStrategyArgument
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| secret | string | *No description.* |
| strategyName | string | *No description.* |
---
##### `secret`Required
```typescript
public readonly secret: string;
```
- *Type:* string
---
##### `strategyName`Required
```typescript
public readonly strategyName: string;
```
- *Type:* string
---
### ITokenVerificationStrategyJwksFromUriByKid
- *Implemented By:* ITokenVerificationStrategyJwksFromUriByKid
#### Properties
| **Name** | **Type** | **Description** |
| --- | --- | --- |
| kid | string | *No description.* |
| strategyName | string | *No description.* |
| uri | string | *No description.* |
---
##### `kid`Required
```typescript
public readonly kid: string;
```
- *Type:* string
---
##### `strategyName`Required
```typescript
public readonly strategyName: string;
```
- *Type:* string
---
##### `uri`Required
```typescript
public readonly uri: string;
```
- *Type:* string
---