Skip to content

Commit f455273

Browse files
DRNagarDRNagar
authored
fix(apigateway): authorizerUri does not resolve to the correct partition (#8152)
Add that the authorizerURI includes the correct partition. Previously, it always used the aws partition. fixes #8098 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 201b468 commit f455273

13 files changed

+445
-306
lines changed

‎packages/@aws-cdk/aws-apigateway/lib/authorizers/lambda.ts

+9-2
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ export class TokenAuthorizer extends LambdaAuthorizer {
170170
name: props.authorizerName ?? this.node.uniqueId,
171171
restApiId,
172172
type: 'TOKEN',
173-
authorizerUri: `arn:aws:apigateway:${Stack.of(this).region}:lambda:path/2015-03-31/functions/${props.handler.functionArn}/invocations`,
173+
authorizerUri: lambdaAuthorizerArn(props.handler),
174174
authorizerCredentials: props.assumeRole?.roleArn,
175175
authorizerResultTtlInSeconds: props.resultsCacheTtl?.toSeconds(),
176176
identitySource: props.identitySource || 'method.request.header.Authorization',
@@ -232,7 +232,7 @@ export class RequestAuthorizer extends LambdaAuthorizer {
232232
name: props.authorizerName ?? this.node.uniqueId,
233233
restApiId,
234234
type: 'REQUEST',
235-
authorizerUri: `arn:aws:apigateway:${Stack.of(this).region}:lambda:path/2015-03-31/functions/${props.handler.functionArn}/invocations`,
235+
authorizerUri: lambdaAuthorizerArn(props.handler),
236236
authorizerCredentials: props.assumeRole?.roleArn,
237237
authorizerResultTtlInSeconds: props.resultsCacheTtl?.toSeconds(),
238238
identitySource: props.identitySources.map(is => is.toString()).join(','),
@@ -248,3 +248,10 @@ export class RequestAuthorizer extends LambdaAuthorizer {
248248
this.setupPermissions();
249249
}
250250
}
251+
252+
/**
253+
* constructs the authorizerURIArn.
254+
*/
255+
function lambdaAuthorizerArn(handler: lambda.IFunction) {
256+
return `arn:${Stack.of(handler).partition}:apigateway:${Stack.of(handler).region}:lambda:path/2015-03-31/functions/${handler.functionArn}/invocations`;
257+
}

‎packages/@aws-cdk/aws-apigateway/lib/integration.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,9 @@ export interface IntegrationProps {
113113
* - If you specify HTTP for the `type` property, specify the API endpoint URL.
114114
* - If you specify MOCK for the `type` property, don't specify this property.
115115
* - If you specify AWS for the `type` property, specify an AWS service that
116-
* follows this form: `arn:aws:apigateway:region:subdomain.service|service:path|action/service_api.`
116+
* follows this form: `arn:partition:apigateway:region:subdomain.service|service:path|action/service_api.`
117117
* For example, a Lambda function URI follows this form:
118-
* arn:aws:apigateway:region:lambda:path/path. The path is usually in the
118+
* arn:partition:apigateway:region:lambda:path/path. The path is usually in the
119119
* form /2015-03-31/functions/LambdaFunctionARN/invocations.
120120
*
121121
* @see https://docs.aws.amazon.com/apigateway/api-reference/resource/integration/#uri

‎packages/@aws-cdk/aws-apigateway/test/authorizers/integ.request-authorizer.expected.json

+29-25
Original file line numberDiff line numberDiff line change
@@ -131,30 +131,6 @@
131131
"Name": "MyRestApi"
132132
}
133133
},
134-
"MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb": {
135-
"Type": "AWS::ApiGateway::Deployment",
136-
"Properties": {
137-
"RestApiId": {
138-
"Ref": "MyRestApi2D1F47A9"
139-
},
140-
"Description": "Automatically created by the RestApi construct"
141-
},
142-
"DependsOn": [
143-
"MyRestApiANY05143F93"
144-
]
145-
},
146-
"MyRestApiDeploymentStageprodC33B8E5F": {
147-
"Type": "AWS::ApiGateway::Stage",
148-
"Properties": {
149-
"RestApiId": {
150-
"Ref": "MyRestApi2D1F47A9"
151-
},
152-
"DeploymentId": {
153-
"Ref": "MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb"
154-
},
155-
"StageName": "prod"
156-
}
157-
},
158134
"MyRestApiCloudWatchRoleD4042E8E": {
159135
"Type": "AWS::IAM::Role",
160136
"Properties": {
@@ -200,6 +176,30 @@
200176
"MyRestApi2D1F47A9"
201177
]
202178
},
179+
"MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb": {
180+
"Type": "AWS::ApiGateway::Deployment",
181+
"Properties": {
182+
"RestApiId": {
183+
"Ref": "MyRestApi2D1F47A9"
184+
},
185+
"Description": "Automatically created by the RestApi construct"
186+
},
187+
"DependsOn": [
188+
"MyRestApiANY05143F93"
189+
]
190+
},
191+
"MyRestApiDeploymentStageprodC33B8E5F": {
192+
"Type": "AWS::ApiGateway::Stage",
193+
"Properties": {
194+
"RestApiId": {
195+
"Ref": "MyRestApi2D1F47A9"
196+
},
197+
"DeploymentId": {
198+
"Ref": "MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb"
199+
},
200+
"StageName": "prod"
201+
}
202+
},
203203
"MyRestApiANY05143F93": {
204204
"Type": "AWS::ApiGateway::Method",
205205
"Properties": {
@@ -247,7 +247,11 @@
247247
"Fn::Join": [
248248
"",
249249
[
250-
"arn:aws:apigateway:",
250+
"arn:",
251+
{
252+
"Ref": "AWS::Partition"
253+
},
254+
":apigateway:",
251255
{
252256
"Ref": "AWS::Region"
253257
},

‎packages/@aws-cdk/aws-apigateway/test/authorizers/integ.token-authorizer-iam-role.expected.json

+29-25
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,11 @@
119119
"Fn::Join": [
120120
"",
121121
[
122-
"arn:aws:apigateway:",
122+
"arn:",
123+
{
124+
"Ref": "AWS::Partition"
125+
},
126+
":apigateway:",
123127
{
124128
"Ref": "AWS::Region"
125129
},
@@ -170,30 +174,6 @@
170174
"Name": "MyRestApi"
171175
}
172176
},
173-
"MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb": {
174-
"Type": "AWS::ApiGateway::Deployment",
175-
"Properties": {
176-
"RestApiId": {
177-
"Ref": "MyRestApi2D1F47A9"
178-
},
179-
"Description": "Automatically created by the RestApi construct"
180-
},
181-
"DependsOn": [
182-
"MyRestApiANY05143F93"
183-
]
184-
},
185-
"MyRestApiDeploymentStageprodC33B8E5F": {
186-
"Type": "AWS::ApiGateway::Stage",
187-
"Properties": {
188-
"RestApiId": {
189-
"Ref": "MyRestApi2D1F47A9"
190-
},
191-
"DeploymentId": {
192-
"Ref": "MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb"
193-
},
194-
"StageName": "prod"
195-
}
196-
},
197177
"MyRestApiCloudWatchRoleD4042E8E": {
198178
"Type": "AWS::IAM::Role",
199179
"Properties": {
@@ -239,6 +219,30 @@
239219
"MyRestApi2D1F47A9"
240220
]
241221
},
222+
"MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb": {
223+
"Type": "AWS::ApiGateway::Deployment",
224+
"Properties": {
225+
"RestApiId": {
226+
"Ref": "MyRestApi2D1F47A9"
227+
},
228+
"Description": "Automatically created by the RestApi construct"
229+
},
230+
"DependsOn": [
231+
"MyRestApiANY05143F93"
232+
]
233+
},
234+
"MyRestApiDeploymentStageprodC33B8E5F": {
235+
"Type": "AWS::ApiGateway::Stage",
236+
"Properties": {
237+
"RestApiId": {
238+
"Ref": "MyRestApi2D1F47A9"
239+
},
240+
"DeploymentId": {
241+
"Ref": "MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb"
242+
},
243+
"StageName": "prod"
244+
}
245+
},
242246
"MyRestApiANY05143F93": {
243247
"Type": "AWS::ApiGateway::Method",
244248
"Properties": {

‎packages/@aws-cdk/aws-apigateway/test/authorizers/integ.token-authorizer.expected.json

+29-25
Original file line numberDiff line numberDiff line change
@@ -131,30 +131,6 @@
131131
"Name": "MyRestApi"
132132
}
133133
},
134-
"MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb": {
135-
"Type": "AWS::ApiGateway::Deployment",
136-
"Properties": {
137-
"RestApiId": {
138-
"Ref": "MyRestApi2D1F47A9"
139-
},
140-
"Description": "Automatically created by the RestApi construct"
141-
},
142-
"DependsOn": [
143-
"MyRestApiANY05143F93"
144-
]
145-
},
146-
"MyRestApiDeploymentStageprodC33B8E5F": {
147-
"Type": "AWS::ApiGateway::Stage",
148-
"Properties": {
149-
"RestApiId": {
150-
"Ref": "MyRestApi2D1F47A9"
151-
},
152-
"DeploymentId": {
153-
"Ref": "MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb"
154-
},
155-
"StageName": "prod"
156-
}
157-
},
158134
"MyRestApiCloudWatchRoleD4042E8E": {
159135
"Type": "AWS::IAM::Role",
160136
"Properties": {
@@ -200,6 +176,30 @@
200176
"MyRestApi2D1F47A9"
201177
]
202178
},
179+
"MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb": {
180+
"Type": "AWS::ApiGateway::Deployment",
181+
"Properties": {
182+
"RestApiId": {
183+
"Ref": "MyRestApi2D1F47A9"
184+
},
185+
"Description": "Automatically created by the RestApi construct"
186+
},
187+
"DependsOn": [
188+
"MyRestApiANY05143F93"
189+
]
190+
},
191+
"MyRestApiDeploymentStageprodC33B8E5F": {
192+
"Type": "AWS::ApiGateway::Stage",
193+
"Properties": {
194+
"RestApiId": {
195+
"Ref": "MyRestApi2D1F47A9"
196+
},
197+
"DeploymentId": {
198+
"Ref": "MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb"
199+
},
200+
"StageName": "prod"
201+
}
202+
},
203203
"MyRestApiANY05143F93": {
204204
"Type": "AWS::ApiGateway::Method",
205205
"Properties": {
@@ -247,7 +247,11 @@
247247
"Fn::Join": [
248248
"",
249249
[
250-
"arn:aws:apigateway:",
250+
"arn:",
251+
{
252+
"Ref": "AWS::Partition"
253+
},
254+
":apigateway:",
251255
{
252256
"Ref": "AWS::Region"
253257
},

0 commit comments

Comments
 (0)