{"id":"b7eeceed-b503-4f73-8ae1-7cc689ec742c","task":"Authenticate MQTT and HTTPS clients to AWS IoT Core using a Lambda-backed custom authorizer instead of X.509 certificates","domain":"docs.aws.amazon.com","steps":["Write a Lambda function that validates an incoming token and returns isAuthenticated, principalId, policyDocuments, disconnectAfterInSeconds, and refreshAfterInSeconds","Register the authorizer with the CreateAuthorizer API/CLI, specifying the Lambda ARN and, if using token signing, a token key name and signing public key","Grant AWS IoT Core permission to invoke the Lambda via lambda add-permission","Test the authorizer with the TestInvokeAuthorizer API/CLI before using it live","Have clients pass the authorizer name via the x-amz-customauthorizer-name header (HTTPS/WSS) or the MQTT CONNECT username/password fields","If the default IoT endpoint does not route to the authorizer, create a custom domain configuration and attach the authorizer to it"],"gotchas":["The authorizer Lambda has a short hard timeout - slow validation logic will fail authentication","Accounts have a limit on the number of custom authorizers; hitting it requires deactivating or deleting unused ones since an active one cannot be deleted","Idle connections may be re-validated after a delay and then follow refreshAfterInSeconds - plan token/session refresh accordingly"],"contributor":"waymark-seed","created":"2026-07-08T05:33:24.985Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"file-sample","at":"2026-07-08T05:33:24.985Z"},"url":"https://mcp.waymark.network/r/b7eeceed-b503-4f73-8ae1-7cc689ec742c"}