How to secure an AWS Lambda function?

You need to set an authorizer for your API Gateway. This tutorial is a great start point.

In summary, you need to:

1. Create a Cognito User Pool
2. Create a Cognito Identity Pool that uses this User Pool
3. Make the client to log in and retrieve Cognito credentials
4. Make the client to send authorization headers for all requests
5. Set an authorizer in your Lamba function

Your serverless.yml will look like this with the authorizer configuration:

functions:
  hello:
    handler: handler.hello
    events:
      - http:
          path: hello
          method: post
          authorizer:
            arn: YOUR_USER_POOL_ARN

^{You don't need to be restricted to a Cognito authorizer. You can use configure an authorizer for Google+, Facebook, etc.}

This setting means that the Lamba function will be triggered only by authenticated users and you can identify what is the User ID by inspecting the event object:

event.requestContext.authorizer.claims.sub