(apigateway): Changes to authorizer does not cause latest deployment to update

[kamzil]

When you have an authorizer that has an imported Lambda from another stack set as handler (authorizerUri), and you change that ARN, authorizer will start failing with AuthorizerConfigurationException on requests to API endpoints that have that authorizer attached.

API Gateway logs reveal that the authorizer is still trying to invoke the Lambda with the old ARN, and fails because Lambda permission has already been replaced with one that contains the new ARN.

This is most likely because CDK won't create a new REST API deployment despite of updating the authorizerUri of the CfnAuthorizer construct.

Reproduction Steps

1. Add a new Lambda, REST API, authorizer and method to your stack. Authorizer Lambda should already exist in another stack:

    // Lambda that should be served via your API
    const yourLambda = new lambda.Function(...)

    // Authorizer that uses a Lambda from another stack
    const authorizerLambdaFuncArn = 'authorizer-lambda-arn-goes-here'
    const someAuthorizer = new TokenAuthorizer(this, 'SomeAuthorizer', {
      authorizerName: 'someAuthorizer',
      handler: Function.fromFunctionArn(this, 'SomeAuthorizerFunction', authorizerLambdaFuncArn),
    })

    // REST API
    const restApi = new RestApi(this, 'SomeApi', {
      restApiName: 'some-api',
    })

    // API method configured with your Lambda and the authorizer
    restApi.root.addMethod('GET', new LambdaIntegration(yourLambda), {
      authorizationType: AuthorizationType.CUSTOM,
      authorizer: someAuthorizer,
    })

2. cdk deploy your stack
3. Requests to your API endpoint should successfully pass to the authorizer
4. Change authorizerLambdaFuncArn to some other Lambda function's ARN
5. Repeat step 2
6. Requests to your API endpoint should now return AuthorizerConfigurationException

What did you expect to happen?

CDK should create a new deployment so that requests will be forwarded to the correct authorizer Lambda

What actually happened?

No new deployment created but Lambda Permission is updated, which leads to permission error.

Environment

• CDK CLI Version : 1.123.0
• Framework Version: 1.123.0
• Node.js Version: v14.17.5
• OS : MacOS 10.15.7
• Language (Version): TypeScript 4.3.5

Other

Workaround:

Add the following in your code:

    if (restApi.latestDeployment) {
      restApi.latestDeployment.addToLogicalId({
        someAuthorizerFunctionArn: authorizerLambdaFuncArn,
      })
    }

This will cause CDK to create a new API deployment.

---

This is 🐛 Bug Report

[nija-at]

Thanks for filing this issue @kamzil. This is indeed a bug on our apigateway module.

Since this has a workaround, I'm marking this as a p2 and unassigning myself. We are unable to work on this immediately.

[jonathan-kosgei]

I ran into this when trying to update the authorizer settings. A new deployment isn't created and I'm not sure how to represent the changes to the authorizer as a string so I can add to the logical id.

@nija-at is there a way to hash the attributes of a construct?

[peterwoodworth]

This was reported internally as well -

The cause is that the deploy? property is only able to pick up the changes to the AWS::ApiGateway::Method resource when there is a change in the template definition of the resource. That is if the LogicalID of the AWS::Lambda::Alias changes thus changing the Uri property of the 'AWS::ApiGateway::Method' resource in the template definition. - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apitgateway-method-integration.html#cfn-apigateway-method-integration-uri
It is not able to pick up the changes if the LogicalID of the AWS::Lambda::Alias does not change, but still the value of the Uri property of the AWS::ApiGateway::Method resource changes. This can happen when AWS::Lambda::Alias resource undergoes replacement update due to a change only in the property Name.
The issue is being caused as the deploy? property only checks the hash of the template definition of the AWS::ApiGateway resources (serialized CloudFormation JSON of CfnRestApi) but not the actual values of the properties of the resources. This is as seen here -

aws-cdk/packages/@aws-cdk/aws-apigateway/lib/deployment.ts

Line 165 in 9f9fe8a

private calculateLogicalId() {

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.