Redirect to built-in sign-in page for AWS Cognito user pool

Question

I have created an API in AWS API Gateway with 1 REST endpoint. The REST endpoint invokes a Lambda function written in C#. I have also created a AWS Cognito user pool. What I am trying to do is integrate AWS Cognito with AWS Gateway API so that when an unauthenticated user attempts to invoke the REST API, the API will redirect them to the built-in sign-in page for AWS Cognito. Currently, I got as far as integrating the 2 together but when I attempt to invoke the REST API, it simply displays an unauthorized message. Instead of displaying that message, I want it to redirect to the sign-in page at that point. I have read through lots of AWS docs and don't know what I am missing. How would I go about doing this?

Answer 1

I was able to solve it by specifying a custom Gateway Response that sends a 302 redirect to the login page in the case of an UNAUTHORIZED response from Cognito. In Terraform, it looks like this:

resource "aws_api_gateway_gateway_response" "unauthorized" {
  rest_api_id   = "${aws_api_gateway_rest_api.apiGateway.id}"
  status_code   = "302"        
  response_type = "UNAUTHORIZED"  

  response_templates = {
    "application/json" = "{'message':$context.error.messageString}"
  }

  response_parameters = {
    "gatewayresponse.header.Location" = "'https://example.com/login'"
  }
}

Answer 2

I figured out a solution to this. I gave up on my original approach and ended up doing this:

1. Created a AWS Cognito User Pool and set the grant type to Implicit in the App client settings (since the HTML/JS website I mention later is a Single Page Application).
2. Created a group and user in the User Pool to test with.
3. Created a REST API in API Gateway that uses an AWS Cognito authorizer.
4. Set up a static website using AWS S3. The static website contains a simple HTML/JS client that uses the AWS Cognito Identity library to authenticate users. Once a user is authenticated, I receive a JWT token from the library. Then, using AJAX, I pass this token to the REST API above.

This accomplishes what I was looking for.