Authorizer Lambdas with Cognito and API Gateway

Cognito can tell you who a user is, but it cannot answer what they are allowed to do. An authorizer Lambda gives you one place to evaluate permissions before a request reaches your backend, with Cognito for identity and a separate permission source for authorization.