private Optional<ValidationEvent> validateAuthSchema(
            Map<String, AuthorizerDefinition> authorizers,
            Model model,
            ServiceShape service
    ) {
        Set<ShapeId> authSchemes = ServiceIndex.of(model).getAuthSchemes(service).keySet();

        String invalidMappings = authorizers.entrySet()
                .stream()
                .filter(entry -> !authSchemes.contains(entry.getValue().getScheme()))
                .map(entry -> entry.getKey() + " -> " + entry.getValue().getScheme())
                .sorted()
                .collect(Collectors.joining(", "));

        if (invalidMappings.isEmpty()) {
            return Optional.empty();
        }

        AuthorizersTrait authorizersTrait = service.getTrait(AuthorizersTrait.class).get();
        return Optional.of(error(service,
                authorizersTrait,
                String.format(
                        "Each `scheme` of the `%s` trait must target one of the auth schemes applied to the service "
                                + "(i.e., [%s]). The following mappings of authorizer names to schemes are invalid: %s",
                        AuthorizersTrait.ID,
                        ValidationUtils.tickedList(authSchemes),
                        invalidMappings)));
    }
Each authorizer resolved within a service must use a scheme that
matches one of the schemes of the protocols of the service.
smithy-aws-apigateway-traits/src/main/java/software/amazon/smithy/aws/apigateway/traits/AuthorizersTraitValidator.java