Lambda Authorizers: Bedrock Policy Explanations With Hard IAM Denies

// authorizer.ts — decision is deterministic; Bedrock is optional narration
import { evaluate } from "./cedar-engine.js";
import { explainDeny } from "./bedrock-explain.js";

export async function handler(event: APIGatewayRequestAuthorizerEvent) {
  const principal = verifyJwt(event.headers?.authorization);
  const decision = evaluate({
    principal,
    action: event.requestContext.routeKey,
    resource: event.path,
    context: { tenantId: principal.tenantId },
  });

  // ✅ Hard gate — model never flips this
  const effect = decision.allowed ? "Allow" : "Deny";

  let explanation: string | undefined;
  if (!decision.allowed && process.env.EXPLAIN_DENIES === "1") {
    try {
      explanation = await explainDeny({
        statements: decision.matchedStatements,
        request: { action: event.requestContext.routeKey, path: event.path },
      });
    } catch {
      // ❌ Never: deny because Bedrock failed — decision already Deny
      explanation = "Denied by policy; explanation unavailable";
    }
  }

  return {
    principalId: principal.sub,
    policyDocument: buildIamPolicy(effect, event.methodArn),
    context: {
      tenantId: principal.tenantId,
      explanation: explanation?.slice(0, 1024) ?? "",
      policyVersion: decision.policyVersion,
    },
  };
}

# bedrock_explain.py — illustrative
SYSTEM = """You explain authorization denials.
Only cite the provided policy statements and request fields.
Never invent permissions. Never suggest bypasses.
Output <= 80 words for the API Gateway authorizer context map."""

def explain_deny(statements: list[dict], request: dict) -> str:
    user = {
        "request": request,
        "matchedStatements": statements,  # from Cedar residual
    }
    # Use Converse with guardrails; low temperature
    return converse_text(system=SYSTEM, user=json.dumps(user), temp=0.1)

// ✅ Optional async explain after Deny response already returned to edge
void queueExplanationJob({ requestId, statements }).catch(() => {});

// ❌ Await 5s Bedrock call inside every authorizer invoke