Implementing basic auth with the Serverless Framework

auth.js

exports.handler = (evt, ctx, callback) => {
  const authorizationHeader = evt.headers.Authorization;

  if (!authorizationHeader) {
    return callback("Unauthorized");
  }

  const encodedCreds = authorizationHeader.split(" ")[1];
  const [username, password] = Buffer.from(encodedCreds, "base64")
    .toString()
    .split(":");

  if (
    username !== process.env.AUTH_USERNAME ||
    password !== process.env.AUTH_PASSWORD
  ) {
    return callback("Unauthorized");
  }

  callback(null, buildAllowAllPolicy(evt, username));
};

function buildAllowAllPolicy(evt, principalId) {
  const tmp = evt.methodArn.split(":");
  const apiGatewayArnTmp = tmp[5].split("/");
  const awsAccountId = tmp[4];
  const awsRegion = tmp[3];
  const restApiId = apiGatewayArnTmp[0];
  const stage = apiGatewayArnTmp[1];
  const apiArn = `arn:aws:execute-api:${awsRegion}:${awsAccountId}:${restApiId}/${stage}/*/*`;
  const policy = {
    principalId,
    policyDocument: {
      Version: "2012-10-17",
      Statement: [
        {
          Action: "execute-api:Invoke",
          Effect: "Allow",
          Resource: [apiArn]
        }
      ]
    }
  };

  return policy;
}

serverless.yml

service: Website

provider:
  name: aws
  runtime: nodejs12.x
  stage: staging
  region: eu-west-1
  environment:
    AUTH_USERNAME: admin
    AUTH_PASSWORD: secret

functions:
  website:
    handler: index.handler
    events:
      - http:
          method: any
          path: /
          authorizer:
            name: basicAuth
            resultTtlInSeconds: 0
            identitySource: method.request.header.Authorization
            type: request
      - http:
          method: any
          path: /{proxy+}
          authorizer:
            name: basicAuth
            resultTtlInSeconds: 0
            identitySource: method.request.header.Authorization
            type: request
  basicAuth:
    handler: auth.handler

resources:
  Resources:
    GatewayResponse:
      Type: AWS::ApiGateway::GatewayResponse
      Properties:
        ResponseParameters:
          gatewayresponse.header.WWW-Authenticate: "'Basic'"
        ResponseType: UNAUTHORIZED
        RestApiId:
          Ref: ApiGatewayRestApi
        StatusCode: '401'