For an application which:
- Will use Google OpenID for account creation & authorization
- I plan on allowing any user to "create an account" which is why I want to use Google for this
- AWS API gateway (to route requests)
- AWS lambda functions (to process requests)
where should authorization live? Authentication is easy, because it's handled by OpenID itself. But imagine I want to be able to have multiple user types - for this example, admin and regular user. Some of my API gateway calls will be protected by the "admin" page.
If I had AWS users, I could use the entire IAM module of AWS to associate users with groups/roles/etc and define authorization that way.
However, I don't - to AWS all my users are the same (OpenID connect users).
I could make my own authorization service to manage permissions based on some of the Google metadata but it seems like this is a common enough situation where there should be a good solution but I've yet to be able to find it.
Do I need to just have a table in an AWS RDS which tracks this? It seems a bit clunky to have to effectively write my own authorization service if I use the Google OpenID.