Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(apigateway): set authorization scope when authorization type is Cognito #30035

Merged
merged 2 commits into from
May 10, 2024

Conversation

GavinZZ
Copy link
Contributor

@GavinZZ GavinZZ commented May 1, 2024

Issue # (if applicable)

Closes #29781

Reason for this change

Authorization scope is set even when the auth type is None. This will cause deployment failure

12:52:11 PM | CREATE_FAILED | AWS::ApiGateway::Method | ActionsApiGatewayI...oxyOPTIONS041B022A
Resource handler returned message: "Invalid Method authorization type specified. Authorization Scopes are only valid for COGNITO_USER_POOLS authorization type (Servic
e: ApiGateway, Status Code: 400, Request ID: f9c6357b-428e-42a8-884c-07b77939d165)" (RequestToken: bb8de2e9-37b7-ca15-9bd8-547bc7eea134, HandlerErrorCode: InvalidRequ
est)

Description of changes

Check when auth type is not Cognito, set auth scope to none. Not a breaking change because original templates cannot deploy.

Description of how you validated changes

All existing and new tests pass.

Checklist


By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

@aws-cdk-automation aws-cdk-automation requested a review from a team May 1, 2024 20:08
@github-actions github-actions bot added bug This issue is a bug. effort/medium Medium work item – several days of effort p1 labels May 1, 2024
@mergify mergify bot added the contribution/core This is a PR that came from AWS. label May 1, 2024
@GavinZZ GavinZZ added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 1, 2024
@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 1, 2024
@GavinZZ GavinZZ marked this pull request as ready for review May 1, 2024 21:10
@GavinZZ GavinZZ added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 1, 2024
Copy link
Contributor

@aaythapa aaythapa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally lgtm, just some clarifying questions

packages/aws-cdk-lib/aws-apigateway/test/method.test.ts Outdated Show resolved Hide resolved
packages/aws-cdk-lib/aws-apigateway/test/method.test.ts Outdated Show resolved Hide resolved
packages/aws-cdk-lib/aws-apigateway/test/method.test.ts Outdated Show resolved Hide resolved
@GavinZZ GavinZZ force-pushed the yuanhaoz/api_auth_scope_fix branch from 831322b to 46ab0e9 Compare May 10, 2024 18:42
Copy link
Contributor

@aaythapa aaythapa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚢

Copy link
Contributor

mergify bot commented May 10, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@aws-cdk-automation aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label May 10, 2024
@aws-cdk-automation
Copy link
Collaborator

AWS CodeBuild CI Report

  • CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
  • Commit ID: 0ba8ff9
  • Result: SUCCEEDED
  • Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

@mergify mergify bot merged commit 38a2284 into main May 10, 2024
15 checks passed
@mergify mergify bot deleted the yuanhaoz/api_auth_scope_fix branch May 10, 2024 21:27
Copy link
Contributor

mergify bot commented May 10, 2024

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

@viktorvoltaire
Copy link

viktorvoltaire commented May 20, 2024

This wiped our scopes, even though we have const authorizer = new CognitoUserPoolsAuthorizer(.... having defined our default options like below wasn't a problem until this was merged. Its also a optional parameter that says

The authorizer will take care of setting the correct authorization type.

        defaultMethodOptions: {
          authorizer: authorizer,
          authorizationScopes: [
            "...."
          ],

This warning log was swallowed by CI/CD but still deployed

[Warning at ...] 'AuthorizationScopes' can only be set when 'AuthorizationType' sets 'COGNITO_USER_POOLS'. Default to ignore the values set in 'AuthorizationScopes'. [ack: @aws-cdk/aws-apigateway:invalidAuthScope]

// When AuthorizationType is None, there shouldn't be any AuthorizationScope since AuthorizationScope should only
// be applied to COGNITO_USER_POOLS AuthorizationType.
const defaultScopes = options.authorizationScopes ?? defaultMethodOptions.authorizationScopes;
const authorizationScopes = authorizationTypeOption === AuthorizationType.COGNITO ? defaultScopes : undefined;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By utilizing authorizationTypeOption instead of authorizationType, you are now forcing people to implement an optional parameter for something was previously set by the authorizer, that was previously recommended to not be set explicitly. It is explicitly stated in the documentation, that the authorizer will set the authorizationType, see line 30 of this file. This is a breaking change.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this just broke our prod environment after a dependabot update - it should be marked as a breaking change 🙁

@aws-cdk-automation
Copy link
Collaborator

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.

@aws aws locked as resolved and limited conversation to collaborators Jul 25, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug This issue is a bug. contribution/core This is a PR that came from AWS. effort/medium Medium work item – several days of effort p1
Projects
None yet
Development

Successfully merging this pull request may close these issues.

apigateway: Can't set default authorization scopes when adding a proxy to a resource
7 participants