API Gateway Authorizer Security

Review and remediate API Gateway authorization findings without adding security theater merely to make a scanner pass.

Authorizer Precedence Rule

Apply exactly one effective authorizer policy to each route:

1. If the route requires Cognito, OIDC JWT, IAM, or custom business authorization, use that real authorizer only.
2. If the route is intentionally public and organizational scanning policy requires an authorizer, an always-allow Lambda authorizer may be used only as the documented fallback.
3. Never replace, wrap, or supplement a real business authorizer with the fallback authorizer.

The fallback authorizer is a scanner-compatibility control, not authentication. Its name, documentation, route inventory, and review output must state that it grants public access.

When to Apply

Use this skill when: