Securing BFF services

In Chapter 6, A Best Friend for the Frontend, we covered the BFF pattern. These services expose a synchronous interface to the frontend, which means they expose an attack surface at the boundary of the system. Fortunately, securing a serverless BFF service in depth is mostly a declarative exercise. We need to grant access to a service, then grant access to the data, track who did what and ensure a service cannot access resources outside the service. Let's discuss these topics in this order.

JWT authorizer

When we left off in the previous section, Securing the frontend, we passed the user's idToken in a request to a BFF service using the Authorization header. Once a request reaches the BFF service, the first step is to authorize the request. The API gateway performs this step, so that we separate the technical concerns of handling the JWT token from the business logic. This also eliminates unnecessary calls to the query and command functions when the request...