Add support for externally managed websocket event authorizers

docs/providers/aws/events/websocket.md

@@ -117,7 +117,7 @@ functions:
     handler: handler.auth
 ```
 
-Or, if your authorizer function is not managed by this service, you can provide an arn instead:
+You also can provide an arn:
 
 ```yml
 functions:
@@ -129,6 +129,19 @@ functions:
           authorizer: arn:aws:lambda:us-east-1:1234567890:function:auth
 ```
 
+If your authorizer is externally managed (not run by this service), you can use `managedExternally` to skip permission creation:
+```yml
+functions:
+  connectHandler:
+    handler: handler.connectHandler
+    events:
+      - websocket:
+          route: $connect
+          authorizer: 
+            arn: arn:aws:lambda:us-east-1:1234567890:function:auth
+            managedExternally: true
+```
+
 By default, the `identitySource` property is set to `route.request.header.Auth`, meaning that your request must include the auth token in the `Auth` header of the request. You can overwrite this by specifying your own `identitySource` configuration:
 
 ```yml

lib/plugins/aws/package/compile/events/websockets/index.js

@@ -71,6 +71,7 @@ class AwsCompileWebsockets {
                     name: { $ref: '#/definitions/functionName' },
                     arn: { $ref: '#/definitions/awsArn' },
                     identitySource: { type: 'array', items: { type: 'string' } },
+                    managedExternally: { type: 'boolean' },
                   },
                   anyOf: [{ required: ['name'] }, { required: ['arn'] }],
                   additionalProperties: false,

lib/plugins/aws/package/compile/events/websockets/lib/permissions.js

@@ -6,6 +6,8 @@ const resolveLambdaTarget = require('../../../../../utils/resolve-lambda-target'
 module.exports = {
   compilePermissions() {
     this.validated.events.forEach((event) => {
+      if (event.authorizer && event.authorizer.managedExternally) return;
+
       const websocketApiId = this.provider.getApiGatewayWebsocketApiId();
       const lambdaLogicalId = this.provider.naming.getLambdaLogicalId(event.functionName);
       const functionObj = this.serverless.service.getFunction(event.functionName);

lib/plugins/aws/package/compile/events/websockets/lib/validate.js

@@ -139,6 +139,10 @@ module.exports = {
               } else {
                 websocketObj.authorizer.identitySource = event.websocket.authorizer.identitySource;
               }
+
+              if (event.websocket.authorizer.managedExternally){
+                websocketObj.authorizer.managedExternally = true;
+              }
             }
             events.push(websocketObj);
             // dealing with the simplified string representation