CognitoAuth

import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';

export default new App({
  run(ctx) {
    const pool = new anvil.aws.CognitoUserPool('users');

    const auth = new anvil.aws.CognitoAuth('auth', {
      userPoolId: pool.userPoolId,
      audience: [pool.appClientId],
    });

    const me = new anvil.aws.Lambda('me', {
      runtime: 'nodejs24.x',
      handler: 'functions/me/index.handler',
    });

    // Every route now needs a valid token; skipAuth opts a route out.
    const api = new anvil.aws.HttpApi('api', {
      defaultAuthorizerId: auth.authorizerId,
      routes: [
        { method: 'GET', path: '/me', consumer: { lambda: { arn: me.arn } } },
        { method: 'GET', path: '/health', consumer: { lambda: { arn: me.arn } }, skipAuth: true },
      ],
    });

    ctx.export('url', api.url);
  },
});

import anvil_cloud as anvil

def infra(ctx: anvil.Context):
    pool = anvil.aws.CognitoUserPool("users")

    auth = anvil.aws.CognitoAuth("auth",
        user_pool_id=pool.user_pool_id,
        audience=[pool.app_client_id],
    )

    me = anvil.aws.Lambda("me",
        runtime="nodejs24.x",
        handler="functions/me/index.handler",
    )

    # Every route now needs a valid token; skip_auth opts a route out.
    api = anvil.aws.HttpApi("api",
        default_authorizer_id=auth.authorizer_id,
        routes=[
            {"method": "GET", "path": "/me", "consumer": {"lambda_": {"arn": me.arn}}},
            {"method": "GET", "path": "/health", "consumer": {"lambda_": {"arn": me.arn}}, "skip_auth": True},
        ],
    )

    ctx.export("url", api.url)

anvil.App(run=infra)

package main

import (
    "github.com/anvil-cloud/anvil/sdk/go/anvil"
    anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
    anvil.Run(anvil.AppConfig{
        Run: func(ctx *anvil.Context) error {
            pool, err := anvilaws.NewCognitoUserPool(ctx.PulumiCtx(), "users", nil)
            if err != nil {
                return err
            }

            auth, err := anvilaws.NewCognitoAuth(ctx.PulumiCtx(), "auth", &anvilaws.CognitoAuthArgs{
                UserPoolId: pool.UserPoolId,
                Audience:   pulumi.StringArray{pool.AppClientId},
            })
            if err != nil {
                return err
            }

            me, err := anvilaws.NewLambda(ctx.PulumiCtx(), "me", &anvilaws.LambdaArgs{
                Runtime: anvilaws.LambdaRuntime_Nodejs24_x,
                Handler: pulumi.String("functions/me/index.handler"),
            })
            if err != nil {
                return err
            }

            // Every route now needs a valid token; SkipAuth opts a route out.
            api, err := anvilaws.NewHttpApi(ctx.PulumiCtx(), "api", &anvilaws.HttpApiArgs{
                DefaultAuthorizerId: auth.AuthorizerId,
                Routes: anvilaws.HttpApiRouteArray{
                    anvilaws.HttpApiRouteArgs{
                        Method:   anvilaws.HttpApiMethod("GET"),
                        Path:     pulumi.String("/me"),
                        Consumer: anvilaws.HttpApiRouteConsumerArgs{Lambda: &anvilaws.HttpApiLambdaConsumerArgs{Arn: me.Arn}},
                    },
                    anvilaws.HttpApiRouteArgs{
                        Method:   anvilaws.HttpApiMethod("GET"),
                        Path:     pulumi.String("/health"),
                        Consumer: anvilaws.HttpApiRouteConsumerArgs{Lambda: &anvilaws.HttpApiLambdaConsumerArgs{Arn: me.Arn}},
                        SkipAuth: pulumi.Bool(true),
                    },
                },
            })
            if err != nil {
                return err
            }

            ctx.Export("url", api.Url)
            return nil
        },
    })
}