fix(apigatewayv2): authorizer is not removed when HttpNoneAuthorizer is used

[njlaw]

CloudFormation will not remove an existing Authorizer if AuthorizationType and AuthorizerId are simply removed. The AuthorizationType must be explicitly set to NONE for CloudFormation to remove the existing Authorizer.

As such, I updated the HttpRoute constructor to include the AuthorizationType even if it is NONE; otherwise it is impossible to remove an authorizer in CDK. Some thought had obviously gone into this previously because of the following line:

aws-cdk/packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts

Line 159 in 2f5eeb0

const authorizationType = authBindResult?.authorizationType === HttpAuthorizerType.NONE ? undefined : authBindResult?.authorizationType;

I did not manage to track down the reasoning for this in commit comments, so I would be interested to hear why this was done, since I may have overlooked a desired use case. I'm wondering if it was assumed that the default CloudFormation value for AuthorizationType is NONE, so to have a more compact template it was omitted. However, the behavior when AuthorizationType is not present, is to not change the existing Authorizer.

Basically in the CloudFormation template,

  APIGETintegrationgoogleapiregister1D8736BD:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId:
        Ref: API62EA1CEE
      RouteKey: GET /integration/google-api/register
      Target: ...

does not have the same effect as

  APIGETintegrationgoogleapiregister1D8736BD:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId:
        Ref: API62EA1CEE
      RouteKey: GET /integration/google-api/register
      AuthorizationType: NONE
      Target: ...

Only the later will remove an existing Authorizer.

If you think this is a bug in CloudFormation and not its intended behavior, please let me know. I am assuming that they would not change the behavior anyway since that could have unintended consequence for anyone who redeploys a template without the AuthorizationType set.

BREAKING CHANGE: setting the authorizer of an API route to HttpNoneAuthorizer will now remove any existing authorizer on the route

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[nija-at]

Thanks for submitting this PR. The approach sounds good.

One suggestion below

[gitpod-io]

Pull request has been modified.

[nija-at]

The build has failed. The link to the build logs are in a comment above.

Pull request has been modified.

[nija-at]

Hi @njlaw - There build is still failing. Likely more snapshot tests that need to be updated.

Pull request has been modified.

[njlaw]

Hi @njlaw - There build is still failing. Likely more snapshot tests that need to be updated.

Thank you @nija-at. I should have some time to get the outstanding test snapshot updates done in the next few days if I don't manage to today.

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject89A8053A-LhjRyN9kxr8o
• Commit ID: afa7ceb
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).