Skip to content

Commit ef72089

Browse files
corymhallcorymhall
authoredOct 12, 2022
fix(apigateway): CORS OPTIONS method should not require auth (#22402)
When you create a RestApi and you provide `defaultCorsPreflightOptions` we automatically create a CORS OPTIONS method for each method. If you also provide `defaultMethodOptions` then those default options get passed through to the CORS OPTION method as well. In the case of authentication options this should not be the case. This PR explicitly sets the authentication related options to NONE values which overrides whatever is provided in `defaultMethodOptions`. I've updated an integration tests to assert that an OPTIONS call is successful (I also tested before the fix to assert that it failed). fixes #8615 ---- ### All Submissions: * [ ] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
·
v2.188.0v2.46.0
1 parent 239215f commit ef72089

File tree

22 files changed

+2688
-733
lines changed

22 files changed

+2688
-733
lines changed
 

‎packages/@aws-cdk/aws-apigateway/README.md

+45-1
Original file line numberDiff line numberDiff line change
@@ -740,7 +740,51 @@ books.addMethod('GET', new apigateway.HttpIntegration('http://amazon.com'), {
740740

741741
A full working example is shown below.
742742

743-
[Full token authorizer example](test/authorizers/integ.token-authorizer.lit.ts).
743+
```ts
744+
import * as path from 'path';
745+
import * as lambda from '@aws-cdk/aws-lambda';
746+
import { App, Stack } from '@aws-cdk/core';
747+
import { MockIntegration, PassthroughBehavior, RestApi, TokenAuthorizer, Cors } from '../../lib';
748+
749+
/// !show
750+
const app = new App();
751+
const stack = new Stack(app, 'TokenAuthorizerInteg');
752+
753+
const authorizerFn = new lambda.Function(stack, 'MyAuthorizerFunction', {
754+
runtime: lambda.Runtime.NODEJS_14_X,
755+
handler: 'index.handler',
756+
code: lambda.AssetCode.fromAsset(path.join(__dirname, 'integ.token-authorizer.handler')),
757+
});
758+
759+
const authorizer = new TokenAuthorizer(stack, 'MyAuthorizer', {
760+
handler: authorizerFn,
761+
});
762+
763+
const restapi = new RestApi(stack, 'MyRestApi', {
764+
cloudWatchRole: true,
765+
defaultMethodOptions: {
766+
authorizer,
767+
},
768+
defaultCorsPreflightOptions: {
769+
allowOrigins: Cors.ALL_ORIGINS,
770+
},
771+
});
772+
773+
774+
restapi.root.addMethod('ANY', new MockIntegration({
775+
integrationResponses: [
776+
{ statusCode: '200' },
777+
],
778+
passthroughBehavior: PassthroughBehavior.NEVER,
779+
requestTemplates: {
780+
'application/json': '{ "statusCode": 200 }',
781+
},
782+
}), {
783+
methodResponses: [
784+
{ statusCode: '200' },
785+
],
786+
});
787+
```
744788

745789
By default, the `TokenAuthorizer` looks for the authorization token in the request header with the key 'Authorization'. This can,
746790
however, be modified by changing the `identitySource` property.

‎packages/@aws-cdk/aws-apigateway/lib/method.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ export class Method extends Resource {
186186

187187
const defaultMethodOptions = props.resource.defaultMethodOptions || {};
188188
const authorizer = options.authorizer || defaultMethodOptions.authorizer;
189-
const authorizerId = authorizer?.authorizerId;
189+
const authorizerId = authorizer?.authorizerId ? authorizer.authorizerId : undefined;
190190

191191
const authorizationTypeOption = options.authorizationType || defaultMethodOptions.authorizationType;
192192
const authorizationType = authorizer?.authorizationType || authorizationTypeOption || AuthorizationType.NONE;

‎packages/@aws-cdk/aws-apigateway/lib/resource.ts

+7-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import { CfnResource, CfnResourceProps } from './apigateway.generated';
44
import { Cors, CorsOptions } from './cors';
55
import { Integration } from './integration';
66
import { MockIntegration } from './integrations';
7-
import { Method, MethodOptions } from './method';
7+
import { Method, MethodOptions, AuthorizationType } from './method';
88
import { IRestApi, RestApi } from './restapi';
99

1010
export interface IResource extends IResourceBase {
@@ -296,6 +296,12 @@ export abstract class ResourceBase extends ResourceConstruct implements IResourc
296296
{ statusCode: `${statusCode}`, responseParameters: integrationResponseParams, responseTemplates: renderResponseTemplate() },
297297
],
298298
}), {
299+
authorizer: {
300+
authorizerId: '',
301+
authorizationType: AuthorizationType.NONE,
302+
},
303+
apiKeyRequired: false,
304+
authorizationType: AuthorizationType.NONE,
299305
methodResponses: [
300306
{ statusCode: `${statusCode}`, responseParameters: methodResponseParams },
301307
],

‎packages/@aws-cdk/aws-apigateway/test/authorizers/integ.token-authorizer.lit.ts

-41
This file was deleted.

‎packages/@aws-cdk/aws-apigateway/test/authorizers/integ.token-authorizer.ts

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
import * as path from 'path';
2+
import * as lambda from '@aws-cdk/aws-lambda';
3+
import { App, Stack, Duration } from '@aws-cdk/core';
4+
import { IntegTest, ExpectedResult, Match } from '@aws-cdk/integ-tests';
5+
import { MockIntegration, PassthroughBehavior, RestApi, TokenAuthorizer, Cors } from '../../lib';
6+
7+
const app = new App();
8+
const stack = new Stack(app, 'TokenAuthorizerInteg');
9+
10+
const authorizerFn = new lambda.Function(stack, 'MyAuthorizerFunction', {
11+
runtime: lambda.Runtime.NODEJS_14_X,
12+
handler: 'index.handler',
13+
code: lambda.AssetCode.fromAsset(path.join(__dirname, 'integ.token-authorizer.handler')),
14+
});
15+
16+
const authorizer = new TokenAuthorizer(stack, 'MyAuthorizer', {
17+
handler: authorizerFn,
18+
});
19+
20+
const restapi = new RestApi(stack, 'MyRestApi', {
21+
cloudWatchRole: true,
22+
defaultMethodOptions: {
23+
authorizer,
24+
},
25+
defaultCorsPreflightOptions: {
26+
allowOrigins: Cors.ALL_ORIGINS,
27+
},
28+
});
29+
30+
31+
restapi.root.addMethod('ANY', new MockIntegration({
32+
integrationResponses: [
33+
{ statusCode: '200' },
34+
],
35+
passthroughBehavior: PassthroughBehavior.NEVER,
36+
requestTemplates: {
37+
'application/json': '{ "statusCode": 200 }',
38+
},
39+
}), {
40+
methodResponses: [
41+
{ statusCode: '200' },
42+
],
43+
});
44+
45+
const integ = new IntegTest(app, 'apigw-token-auth', {
46+
testCases: [stack],
47+
});
48+
const hostName = `${restapi.restApiId}.execute-api.${stack.region}.${stack.urlSuffix}`;
49+
const testFunc = new lambda.Function(stack, 'InvokeFunction', {
50+
memorySize: 250,
51+
timeout: Duration.seconds(10),
52+
code: lambda.Code.fromInline(`
53+
const https = require('https');
54+
const options = {
55+
hostname: '${hostName}',
56+
path: '/${restapi.deploymentStage.stageName}',
57+
};
58+
exports.handler = async function(event) {
59+
console.log(event);
60+
options.method = event.method;
61+
if ('authorization' in event) {
62+
options.headers = {
63+
Authorization: event.authorization,
64+
};
65+
}
66+
let dataString = '';
67+
const response = await new Promise((resolve, reject) => {
68+
const req = https.request(options, (res) => {
69+
res.on('data', data => {
70+
dataString += data;
71+
})
72+
res.on('end', () => {
73+
resolve({
74+
statusCode: res.statusCode,
75+
body: dataString,
76+
});
77+
})
78+
});
79+
req.on('error', err => {
80+
reject({
81+
statusCode: 500,
82+
body: JSON.stringify({
83+
cause: 'Something went wrong',
84+
error: err,
85+
})
86+
});
87+
});
88+
req.end();
89+
});
90+
return response;
91+
}
92+
`),
93+
handler: 'index.handler',
94+
runtime: lambda.Runtime.NODEJS_16_X,
95+
});
96+
97+
const invokeGet = integ.assertions.invokeFunction({
98+
functionName: testFunc.functionName,
99+
payload: JSON.stringify({
100+
method: 'GET',
101+
authorization: 'allow',
102+
}),
103+
});
104+
invokeGet.expect(ExpectedResult.objectLike({
105+
Payload: Match.stringLikeRegexp('200'),
106+
}));
107+
108+
const invokeGetDeny = integ.assertions.invokeFunction({
109+
functionName: testFunc.functionName,
110+
payload: JSON.stringify({
111+
method: 'GET',
112+
authorization: 'deny',
113+
}),
114+
});
115+
invokeGetDeny.expect(ExpectedResult.objectLike({
116+
Payload: Match.stringLikeRegexp('User is not authorized to access this resource with an explicit deny'),
117+
}));
118+
119+
const invokeOptions = integ.assertions.invokeFunction({
120+
functionName: testFunc.functionName,
121+
payload: JSON.stringify({
122+
method: 'OPTIONS',
123+
}),
124+
});
125+
invokeOptions.expect(ExpectedResult.objectLike({
126+
Payload: Match.stringLikeRegexp('204'),
127+
}));

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.lit.integ.snapshot/TokenAuthorizerInteg.assets.json ‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/TokenAuthorizerInteg.assets.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "20.0.0",
2+
"version": "21.0.0",
33
"files": {
44
"fec8e8354e12687c5a4b843b4e269741f53dec634946869b276f7fd1017845c3": {
55
"source": {
@@ -14,15 +14,15 @@
1414
}
1515
}
1616
},
17-
"d121ee9744a20c9af43e516c8fb4fe93d1ed9b26130e2db68ed9534c7104c866": {
17+
"d48b90b340d35b9bc726b78e652d17148e2449f6f756e4377428635071f68d09": {
1818
"source": {
1919
"path": "TokenAuthorizerInteg.template.json",
2020
"packaging": "file"
2121
},
2222
"destinations": {
2323
"current_account-current_region": {
2424
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25-
"objectKey": "d121ee9744a20c9af43e516c8fb4fe93d1ed9b26130e2db68ed9534c7104c866.json",
25+
"objectKey": "d48b90b340d35b9bc726b78e652d17148e2449f6f756e4377428635071f68d09.json",
2626
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
2727
}
2828
}

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.lit.integ.snapshot/TokenAuthorizerInteg.template.json ‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/TokenAuthorizerInteg.template.json

+183-57
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,66 @@
9393
}
9494
}
9595
},
96+
"MyAuthorizer6575980E": {
97+
"Type": "AWS::ApiGateway::Authorizer",
98+
"Properties": {
99+
"Name": "TokenAuthorizerIntegMyAuthorizer793B1D5F",
100+
"RestApiId": {
101+
"Ref": "MyRestApi2D1F47A9"
102+
},
103+
"Type": "TOKEN",
104+
"AuthorizerUri": {
105+
"Fn::Join": [
106+
"",
107+
[
108+
"arn:",
109+
{
110+
"Fn::Select": [
111+
1,
112+
{
113+
"Fn::Split": [
114+
":",
115+
{
116+
"Fn::GetAtt": [
117+
"MyAuthorizerFunction70F1223E",
118+
"Arn"
119+
]
120+
}
121+
]
122+
}
123+
]
124+
},
125+
":apigateway:",
126+
{
127+
"Fn::Select": [
128+
3,
129+
{
130+
"Fn::Split": [
131+
":",
132+
{
133+
"Fn::GetAtt": [
134+
"MyAuthorizerFunction70F1223E",
135+
"Arn"
136+
]
137+
}
138+
]
139+
}
140+
]
141+
},
142+
":lambda:path/2015-03-31/functions/",
143+
{
144+
"Fn::GetAtt": [
145+
"MyAuthorizerFunction70F1223E",
146+
"Arn"
147+
]
148+
},
149+
"/invocations"
150+
]
151+
]
152+
},
153+
"IdentitySource": "method.request.header.Authorization"
154+
}
155+
},
96156
"MyRestApi2D1F47A9": {
97157
"Type": "AWS::ApiGateway::RestApi",
98158
"Properties": {
@@ -148,7 +208,7 @@
148208
"UpdateReplacePolicy": "Retain",
149209
"DeletionPolicy": "Retain"
150210
},
151-
"MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb": {
211+
"MyRestApiDeploymentB555B582464879c8d1f9fcce2500f142532cdaec": {
152212
"Type": "AWS::ApiGateway::Deployment",
153213
"Properties": {
154214
"RestApiId": {
@@ -157,7 +217,8 @@
157217
"Description": "Automatically created by the RestApi construct"
158218
},
159219
"DependsOn": [
160-
"MyRestApiANY05143F93"
220+
"MyRestApiANY05143F93",
221+
"MyRestApiOPTIONS43BD7BF4"
161222
]
162223
},
163224
"MyRestApiDeploymentStageprodC33B8E5F": {
@@ -167,14 +228,56 @@
167228
"Ref": "MyRestApi2D1F47A9"
168229
},
169230
"DeploymentId": {
170-
"Ref": "MyRestApiDeploymentB555B582dcff966d69deeda8d47e3bf409ce29cb"
231+
"Ref": "MyRestApiDeploymentB555B582464879c8d1f9fcce2500f142532cdaec"
171232
},
172233
"StageName": "prod"
173234
},
174235
"DependsOn": [
175236
"MyRestApiAccount2FB6DB7A"
176237
]
177238
},
239+
"MyRestApiOPTIONS43BD7BF4": {
240+
"Type": "AWS::ApiGateway::Method",
241+
"Properties": {
242+
"HttpMethod": "OPTIONS",
243+
"ResourceId": {
244+
"Fn::GetAtt": [
245+
"MyRestApi2D1F47A9",
246+
"RootResourceId"
247+
]
248+
},
249+
"RestApiId": {
250+
"Ref": "MyRestApi2D1F47A9"
251+
},
252+
"AuthorizationType": "NONE",
253+
"Integration": {
254+
"IntegrationResponses": [
255+
{
256+
"ResponseParameters": {
257+
"method.response.header.Access-Control-Allow-Headers": "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent'",
258+
"method.response.header.Access-Control-Allow-Origin": "'*'",
259+
"method.response.header.Access-Control-Allow-Methods": "'OPTIONS,GET,PUT,POST,DELETE,PATCH,HEAD'"
260+
},
261+
"StatusCode": "204"
262+
}
263+
],
264+
"RequestTemplates": {
265+
"application/json": "{ statusCode: 200 }"
266+
},
267+
"Type": "MOCK"
268+
},
269+
"MethodResponses": [
270+
{
271+
"ResponseParameters": {
272+
"method.response.header.Access-Control-Allow-Headers": true,
273+
"method.response.header.Access-Control-Allow-Origin": true,
274+
"method.response.header.Access-Control-Allow-Methods": true
275+
},
276+
"StatusCode": "204"
277+
}
278+
]
279+
}
280+
},
178281
"MyRestApiANY05143F93": {
179282
"Type": "AWS::ApiGateway::Method",
180283
"Properties": {
@@ -211,65 +314,80 @@
211314
]
212315
}
213316
},
214-
"MyAuthorizer6575980E": {
215-
"Type": "AWS::ApiGateway::Authorizer",
317+
"InvokeFunctionServiceRole3B980FD2": {
318+
"Type": "AWS::IAM::Role",
216319
"Properties": {
217-
"Name": "TokenAuthorizerIntegMyAuthorizer793B1D5F",
218-
"RestApiId": {
219-
"Ref": "MyRestApi2D1F47A9"
320+
"AssumeRolePolicyDocument": {
321+
"Statement": [
322+
{
323+
"Action": "sts:AssumeRole",
324+
"Effect": "Allow",
325+
"Principal": {
326+
"Service": "lambda.amazonaws.com"
327+
}
328+
}
329+
],
330+
"Version": "2012-10-17"
220331
},
221-
"Type": "TOKEN",
222-
"AuthorizerUri": {
223-
"Fn::Join": [
224-
"",
225-
[
226-
"arn:",
227-
{
228-
"Fn::Select": [
229-
1,
230-
{
231-
"Fn::Split": [
232-
":",
233-
{
234-
"Fn::GetAtt": [
235-
"MyAuthorizerFunction70F1223E",
236-
"Arn"
237-
]
238-
}
239-
]
240-
}
241-
]
242-
},
243-
":apigateway:",
244-
{
245-
"Fn::Select": [
246-
3,
247-
{
248-
"Fn::Split": [
249-
":",
250-
{
251-
"Fn::GetAtt": [
252-
"MyAuthorizerFunction70F1223E",
253-
"Arn"
254-
]
255-
}
256-
]
257-
}
258-
]
259-
},
260-
":lambda:path/2015-03-31/functions/",
261-
{
262-
"Fn::GetAtt": [
263-
"MyAuthorizerFunction70F1223E",
264-
"Arn"
265-
]
266-
},
267-
"/invocations"
332+
"ManagedPolicyArns": [
333+
{
334+
"Fn::Join": [
335+
"",
336+
[
337+
"arn:",
338+
{
339+
"Ref": "AWS::Partition"
340+
},
341+
":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
342+
]
268343
]
344+
}
345+
]
346+
}
347+
},
348+
"InvokeFunctionC517E46D": {
349+
"Type": "AWS::Lambda::Function",
350+
"Properties": {
351+
"Code": {
352+
"ZipFile": {
353+
"Fn::Join": [
354+
"",
355+
[
356+
"\nconst https = require('https');\nconst options = {\n hostname: '",
357+
{
358+
"Ref": "MyRestApi2D1F47A9"
359+
},
360+
".execute-api.",
361+
{
362+
"Ref": "AWS::Region"
363+
},
364+
".",
365+
{
366+
"Ref": "AWS::URLSuffix"
367+
},
368+
"',\n path: '/",
369+
{
370+
"Ref": "MyRestApiDeploymentStageprodC33B8E5F"
371+
},
372+
"',\n};\nexports.handler = async function(event) {\n console.log(event);\n options.method = event.method;\n if ('authorization' in event) {\n options.headers = {\n Authorization: event.authorization,\n };\n }\n let dataString = '';\n const response = await new Promise((resolve, reject) => {\n const req = https.request(options, (res) => {\n res.on('data', data => {\n dataString += data;\n })\n res.on('end', () => {\n resolve({\n statusCode: res.statusCode,\n body: dataString,\n });\n })\n });\n req.on('error', err => {\n reject({\n statusCode: 500,\n body: JSON.stringify({\n cause: 'Something went wrong',\n error: err,\n })\n });\n });\n req.end();\n });\n return response;\n}\n"
373+
]
374+
]
375+
}
376+
},
377+
"Role": {
378+
"Fn::GetAtt": [
379+
"InvokeFunctionServiceRole3B980FD2",
380+
"Arn"
269381
]
270382
},
271-
"IdentitySource": "method.request.header.Authorization"
272-
}
383+
"Handler": "index.handler",
384+
"MemorySize": 250,
385+
"Runtime": "nodejs16.x",
386+
"Timeout": 10
387+
},
388+
"DependsOn": [
389+
"InvokeFunctionServiceRole3B980FD2"
390+
]
273391
}
274392
},
275393
"Outputs": {
@@ -298,6 +416,14 @@
298416
]
299417
]
300418
}
419+
},
420+
"ExportsOutputRefInvokeFunctionC517E46D32C855B5": {
421+
"Value": {
422+
"Ref": "InvokeFunctionC517E46D"
423+
},
424+
"Export": {
425+
"Name": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
426+
}
301427
}
302428
},
303429
"Parameters": {

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/apigwtokenauthDefaultTestDeployAssert2CF60E05.assets.json

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"version": "21.0.0",
3+
"files": {
4+
"456da4984f762c1c25e94bd5f2df6758d2b0884d0dae8ca59bb8f4e3de7c2136": {
5+
"source": {
6+
"path": "asset.456da4984f762c1c25e94bd5f2df6758d2b0884d0dae8ca59bb8f4e3de7c2136.bundle",
7+
"packaging": "zip"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "456da4984f762c1c25e94bd5f2df6758d2b0884d0dae8ca59bb8f4e3de7c2136.zip",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
},
17+
"663a8c1a16f9e427d0ecfe2215cb471b582dfce87e95f6bbf85d32c371692ece": {
18+
"source": {
19+
"path": "apigwtokenauthDefaultTestDeployAssert2CF60E05.template.json",
20+
"packaging": "file"
21+
},
22+
"destinations": {
23+
"current_account-current_region": {
24+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25+
"objectKey": "663a8c1a16f9e427d0ecfe2215cb471b582dfce87e95f6bbf85d32c371692ece.json",
26+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
27+
}
28+
}
29+
}
30+
},
31+
"dockerImages": {}
32+
}

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/apigwtokenauthDefaultTestDeployAssert2CF60E05.template.json

+353
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,353 @@
1+
{
2+
"Resources": {
3+
"LambdaInvoke3deec958b1e945795e38da5fc2f86753": {
4+
"Type": "Custom::DeployAssert@SdkCallLambdainvoke",
5+
"Properties": {
6+
"ServiceToken": {
7+
"Fn::GetAtt": [
8+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F",
9+
"Arn"
10+
]
11+
},
12+
"service": "Lambda",
13+
"api": "invoke",
14+
"expected": "{\"$ObjectLike\":{\"Payload\":{\"$StringLike\":\"200\"}}}",
15+
"parameters": {
16+
"FunctionName": {
17+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
18+
},
19+
"Payload": "{\"method\":\"GET\",\"authorization\":\"allow\"}"
20+
},
21+
"flattenResponse": "false",
22+
"salt": "1665080757293"
23+
},
24+
"UpdateReplacePolicy": "Delete",
25+
"DeletionPolicy": "Delete"
26+
},
27+
"LambdaInvoke3deec958b1e945795e38da5fc2f86753InvokeCB0E5D28": {
28+
"Type": "AWS::Lambda::Permission",
29+
"Properties": {
30+
"Action": "lambda:InvokeFunction",
31+
"FunctionName": {
32+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
33+
},
34+
"Principal": {
35+
"Fn::GetAtt": [
36+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73",
37+
"Arn"
38+
]
39+
}
40+
}
41+
},
42+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73": {
43+
"Type": "AWS::IAM::Role",
44+
"Properties": {
45+
"AssumeRolePolicyDocument": {
46+
"Version": "2012-10-17",
47+
"Statement": [
48+
{
49+
"Action": "sts:AssumeRole",
50+
"Effect": "Allow",
51+
"Principal": {
52+
"Service": "lambda.amazonaws.com"
53+
}
54+
}
55+
]
56+
},
57+
"ManagedPolicyArns": [
58+
{
59+
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
60+
}
61+
],
62+
"Policies": [
63+
{
64+
"PolicyName": "Inline",
65+
"PolicyDocument": {
66+
"Version": "2012-10-17",
67+
"Statement": [
68+
{
69+
"Action": [
70+
"lambda:Invoke"
71+
],
72+
"Effect": "Allow",
73+
"Resource": [
74+
"*"
75+
]
76+
},
77+
{
78+
"Action": [
79+
"lambda:InvokeFunction"
80+
],
81+
"Effect": "Allow",
82+
"Resource": [
83+
{
84+
"Fn::Join": [
85+
"",
86+
[
87+
"arn:",
88+
{
89+
"Ref": "AWS::Partition"
90+
},
91+
":lambda:",
92+
{
93+
"Ref": "AWS::Region"
94+
},
95+
":",
96+
{
97+
"Ref": "AWS::AccountId"
98+
},
99+
":function:",
100+
{
101+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
102+
}
103+
]
104+
]
105+
}
106+
]
107+
},
108+
{
109+
"Action": [
110+
"lambda:Invoke"
111+
],
112+
"Effect": "Allow",
113+
"Resource": [
114+
"*"
115+
]
116+
},
117+
{
118+
"Action": [
119+
"lambda:InvokeFunction"
120+
],
121+
"Effect": "Allow",
122+
"Resource": [
123+
{
124+
"Fn::Join": [
125+
"",
126+
[
127+
"arn:",
128+
{
129+
"Ref": "AWS::Partition"
130+
},
131+
":lambda:",
132+
{
133+
"Ref": "AWS::Region"
134+
},
135+
":",
136+
{
137+
"Ref": "AWS::AccountId"
138+
},
139+
":function:",
140+
{
141+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
142+
}
143+
]
144+
]
145+
}
146+
]
147+
},
148+
{
149+
"Action": [
150+
"lambda:Invoke"
151+
],
152+
"Effect": "Allow",
153+
"Resource": [
154+
"*"
155+
]
156+
},
157+
{
158+
"Action": [
159+
"lambda:InvokeFunction"
160+
],
161+
"Effect": "Allow",
162+
"Resource": [
163+
{
164+
"Fn::Join": [
165+
"",
166+
[
167+
"arn:",
168+
{
169+
"Ref": "AWS::Partition"
170+
},
171+
":lambda:",
172+
{
173+
"Ref": "AWS::Region"
174+
},
175+
":",
176+
{
177+
"Ref": "AWS::AccountId"
178+
},
179+
":function:",
180+
{
181+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
182+
}
183+
]
184+
]
185+
}
186+
]
187+
}
188+
]
189+
}
190+
}
191+
]
192+
}
193+
},
194+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F": {
195+
"Type": "AWS::Lambda::Function",
196+
"Properties": {
197+
"Runtime": "nodejs14.x",
198+
"Code": {
199+
"S3Bucket": {
200+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
201+
},
202+
"S3Key": "456da4984f762c1c25e94bd5f2df6758d2b0884d0dae8ca59bb8f4e3de7c2136.zip"
203+
},
204+
"Timeout": 120,
205+
"Handler": "index.handler",
206+
"Role": {
207+
"Fn::GetAtt": [
208+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73",
209+
"Arn"
210+
]
211+
}
212+
}
213+
},
214+
"LambdaInvoke8e1b9f979f2329abf1ed6574d33d391a": {
215+
"Type": "Custom::DeployAssert@SdkCallLambdainvoke",
216+
"Properties": {
217+
"ServiceToken": {
218+
"Fn::GetAtt": [
219+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F",
220+
"Arn"
221+
]
222+
},
223+
"service": "Lambda",
224+
"api": "invoke",
225+
"expected": "{\"$ObjectLike\":{\"Payload\":{\"$StringLike\":\"User is not authorized to access this resource with an explicit deny\"}}}",
226+
"parameters": {
227+
"FunctionName": {
228+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
229+
},
230+
"Payload": "{\"method\":\"GET\",\"authorization\":\"deny\"}"
231+
},
232+
"flattenResponse": "false",
233+
"salt": "1665080757294"
234+
},
235+
"UpdateReplacePolicy": "Delete",
236+
"DeletionPolicy": "Delete"
237+
},
238+
"LambdaInvoke8e1b9f979f2329abf1ed6574d33d391aInvokeCCB91944": {
239+
"Type": "AWS::Lambda::Permission",
240+
"Properties": {
241+
"Action": "lambda:InvokeFunction",
242+
"FunctionName": {
243+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
244+
},
245+
"Principal": {
246+
"Fn::GetAtt": [
247+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73",
248+
"Arn"
249+
]
250+
}
251+
}
252+
},
253+
"LambdaInvoke0532e3d95b2a56b147278c621e5800c4": {
254+
"Type": "Custom::DeployAssert@SdkCallLambdainvoke",
255+
"Properties": {
256+
"ServiceToken": {
257+
"Fn::GetAtt": [
258+
"SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F",
259+
"Arn"
260+
]
261+
},
262+
"service": "Lambda",
263+
"api": "invoke",
264+
"expected": "{\"$ObjectLike\":{\"Payload\":{\"$StringLike\":\"204\"}}}",
265+
"parameters": {
266+
"FunctionName": {
267+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
268+
},
269+
"Payload": "{\"method\":\"OPTIONS\"}"
270+
},
271+
"flattenResponse": "false",
272+
"salt": "1665080757295"
273+
},
274+
"UpdateReplacePolicy": "Delete",
275+
"DeletionPolicy": "Delete"
276+
},
277+
"LambdaInvoke0532e3d95b2a56b147278c621e5800c4Invoke73472D9F": {
278+
"Type": "AWS::Lambda::Permission",
279+
"Properties": {
280+
"Action": "lambda:InvokeFunction",
281+
"FunctionName": {
282+
"Fn::ImportValue": "TokenAuthorizerInteg:ExportsOutputRefInvokeFunctionC517E46D32C855B5"
283+
},
284+
"Principal": {
285+
"Fn::GetAtt": [
286+
"SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73",
287+
"Arn"
288+
]
289+
}
290+
}
291+
}
292+
},
293+
"Outputs": {
294+
"AssertionResultsLambdaInvoke3deec958b1e945795e38da5fc2f86753": {
295+
"Value": {
296+
"Fn::GetAtt": [
297+
"LambdaInvoke3deec958b1e945795e38da5fc2f86753",
298+
"assertion"
299+
]
300+
}
301+
},
302+
"AssertionResultsLambdaInvoke8e1b9f979f2329abf1ed6574d33d391a": {
303+
"Value": {
304+
"Fn::GetAtt": [
305+
"LambdaInvoke8e1b9f979f2329abf1ed6574d33d391a",
306+
"assertion"
307+
]
308+
}
309+
},
310+
"AssertionResultsLambdaInvoke0532e3d95b2a56b147278c621e5800c4": {
311+
"Value": {
312+
"Fn::GetAtt": [
313+
"LambdaInvoke0532e3d95b2a56b147278c621e5800c4",
314+
"assertion"
315+
]
316+
}
317+
}
318+
},
319+
"Parameters": {
320+
"BootstrapVersion": {
321+
"Type": "AWS::SSM::Parameter::Value<String>",
322+
"Default": "/cdk-bootstrap/hnb659fds/version",
323+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
324+
}
325+
},
326+
"Rules": {
327+
"CheckBootstrapVersion": {
328+
"Assertions": [
329+
{
330+
"Assert": {
331+
"Fn::Not": [
332+
{
333+
"Fn::Contains": [
334+
[
335+
"1",
336+
"2",
337+
"3",
338+
"4",
339+
"5"
340+
],
341+
{
342+
"Ref": "BootstrapVersion"
343+
}
344+
]
345+
}
346+
]
347+
},
348+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
349+
}
350+
]
351+
}
352+
}
353+
}

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/asset.456da4984f762c1c25e94bd5f2df6758d2b0884d0dae8ca59bb8f4e3de7c2136.bundle/index.js

+668
Large diffs are not rendered by default.

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"21.0.0"}

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "21.0.0",
3+
"testCases": {
4+
"apigw-token-auth/DefaultTest": {
5+
"stacks": [
6+
"TokenAuthorizerInteg"
7+
],
8+
"assertionStack": "apigw-token-auth/DefaultTest/DeployAssert",
9+
"assertionStackName": "apigwtokenauthDefaultTestDeployAssert2CF60E05"
10+
}
11+
}
12+
}

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/manifest.json

+262
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
{
2+
"version": "21.0.0",
3+
"artifacts": {
4+
"Tree": {
5+
"type": "cdk:tree",
6+
"properties": {
7+
"file": "tree.json"
8+
}
9+
},
10+
"TokenAuthorizerInteg.assets": {
11+
"type": "cdk:asset-manifest",
12+
"properties": {
13+
"file": "TokenAuthorizerInteg.assets.json",
14+
"requiresBootstrapStackVersion": 6,
15+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
16+
}
17+
},
18+
"TokenAuthorizerInteg": {
19+
"type": "aws:cloudformation:stack",
20+
"environment": "aws://unknown-account/unknown-region",
21+
"properties": {
22+
"templateFile": "TokenAuthorizerInteg.template.json",
23+
"validateOnSynth": false,
24+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
25+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
26+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/d48b90b340d35b9bc726b78e652d17148e2449f6f756e4377428635071f68d09.json",
27+
"requiresBootstrapStackVersion": 6,
28+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
29+
"additionalDependencies": [
30+
"TokenAuthorizerInteg.assets"
31+
],
32+
"lookupRole": {
33+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
34+
"requiresBootstrapStackVersion": 8,
35+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
36+
}
37+
},
38+
"dependencies": [
39+
"TokenAuthorizerInteg.assets"
40+
],
41+
"metadata": {
42+
"/TokenAuthorizerInteg/MyAuthorizerFunction/ServiceRole/Resource": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "MyAuthorizerFunctionServiceRole8A34C19E"
46+
}
47+
],
48+
"/TokenAuthorizerInteg/MyAuthorizerFunction/Resource": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "MyAuthorizerFunction70F1223E"
52+
}
53+
],
54+
"/TokenAuthorizerInteg/MyAuthorizerFunction/TokenAuthorizerIntegMyAuthorizer793B1D5F:Permissions": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "MyAuthorizerFunctionTokenAuthorizerIntegMyAuthorizer793B1D5FPermissions7557AE26"
58+
}
59+
],
60+
"/TokenAuthorizerInteg/MyAuthorizer/Resource": [
61+
{
62+
"type": "aws:cdk:logicalId",
63+
"data": "MyAuthorizer6575980E"
64+
}
65+
],
66+
"/TokenAuthorizerInteg/MyRestApi/Resource": [
67+
{
68+
"type": "aws:cdk:logicalId",
69+
"data": "MyRestApi2D1F47A9"
70+
}
71+
],
72+
"/TokenAuthorizerInteg/MyRestApi/CloudWatchRole/Resource": [
73+
{
74+
"type": "aws:cdk:logicalId",
75+
"data": "MyRestApiCloudWatchRoleD4042E8E"
76+
}
77+
],
78+
"/TokenAuthorizerInteg/MyRestApi/Account": [
79+
{
80+
"type": "aws:cdk:logicalId",
81+
"data": "MyRestApiAccount2FB6DB7A"
82+
}
83+
],
84+
"/TokenAuthorizerInteg/MyRestApi/Deployment/Resource": [
85+
{
86+
"type": "aws:cdk:logicalId",
87+
"data": "MyRestApiDeploymentB555B582464879c8d1f9fcce2500f142532cdaec"
88+
}
89+
],
90+
"/TokenAuthorizerInteg/MyRestApi/DeploymentStage.prod/Resource": [
91+
{
92+
"type": "aws:cdk:logicalId",
93+
"data": "MyRestApiDeploymentStageprodC33B8E5F"
94+
}
95+
],
96+
"/TokenAuthorizerInteg/MyRestApi/Endpoint": [
97+
{
98+
"type": "aws:cdk:logicalId",
99+
"data": "MyRestApiEndpoint4C55E4CB"
100+
}
101+
],
102+
"/TokenAuthorizerInteg/MyRestApi/Default/OPTIONS/Resource": [
103+
{
104+
"type": "aws:cdk:logicalId",
105+
"data": "MyRestApiOPTIONS43BD7BF4"
106+
}
107+
],
108+
"/TokenAuthorizerInteg/MyRestApi/Default/ANY/Resource": [
109+
{
110+
"type": "aws:cdk:logicalId",
111+
"data": "MyRestApiANY05143F93"
112+
}
113+
],
114+
"/TokenAuthorizerInteg/InvokeFunction/ServiceRole/Resource": [
115+
{
116+
"type": "aws:cdk:logicalId",
117+
"data": "InvokeFunctionServiceRole3B980FD2"
118+
}
119+
],
120+
"/TokenAuthorizerInteg/InvokeFunction/Resource": [
121+
{
122+
"type": "aws:cdk:logicalId",
123+
"data": "InvokeFunctionC517E46D"
124+
}
125+
],
126+
"/TokenAuthorizerInteg/Exports/Output{\"Ref\":\"InvokeFunctionC517E46D\"}": [
127+
{
128+
"type": "aws:cdk:logicalId",
129+
"data": "ExportsOutputRefInvokeFunctionC517E46D32C855B5"
130+
}
131+
],
132+
"/TokenAuthorizerInteg/BootstrapVersion": [
133+
{
134+
"type": "aws:cdk:logicalId",
135+
"data": "BootstrapVersion"
136+
}
137+
],
138+
"/TokenAuthorizerInteg/CheckBootstrapVersion": [
139+
{
140+
"type": "aws:cdk:logicalId",
141+
"data": "CheckBootstrapVersion"
142+
}
143+
]
144+
},
145+
"displayName": "TokenAuthorizerInteg"
146+
},
147+
"apigwtokenauthDefaultTestDeployAssert2CF60E05.assets": {
148+
"type": "cdk:asset-manifest",
149+
"properties": {
150+
"file": "apigwtokenauthDefaultTestDeployAssert2CF60E05.assets.json",
151+
"requiresBootstrapStackVersion": 6,
152+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
153+
}
154+
},
155+
"apigwtokenauthDefaultTestDeployAssert2CF60E05": {
156+
"type": "aws:cloudformation:stack",
157+
"environment": "aws://unknown-account/unknown-region",
158+
"properties": {
159+
"templateFile": "apigwtokenauthDefaultTestDeployAssert2CF60E05.template.json",
160+
"validateOnSynth": false,
161+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
162+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
163+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/663a8c1a16f9e427d0ecfe2215cb471b582dfce87e95f6bbf85d32c371692ece.json",
164+
"requiresBootstrapStackVersion": 6,
165+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
166+
"additionalDependencies": [
167+
"apigwtokenauthDefaultTestDeployAssert2CF60E05.assets"
168+
],
169+
"lookupRole": {
170+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
171+
"requiresBootstrapStackVersion": 8,
172+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
173+
}
174+
},
175+
"dependencies": [
176+
"TokenAuthorizerInteg",
177+
"apigwtokenauthDefaultTestDeployAssert2CF60E05.assets"
178+
],
179+
"metadata": {
180+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke3deec958b1e945795e38da5fc2f86753/Default/Default": [
181+
{
182+
"type": "aws:cdk:logicalId",
183+
"data": "LambdaInvoke3deec958b1e945795e38da5fc2f86753"
184+
}
185+
],
186+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke3deec958b1e945795e38da5fc2f86753/Invoke": [
187+
{
188+
"type": "aws:cdk:logicalId",
189+
"data": "LambdaInvoke3deec958b1e945795e38da5fc2f86753InvokeCB0E5D28"
190+
}
191+
],
192+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke3deec958b1e945795e38da5fc2f86753/AssertionResults": [
193+
{
194+
"type": "aws:cdk:logicalId",
195+
"data": "AssertionResultsLambdaInvoke3deec958b1e945795e38da5fc2f86753"
196+
}
197+
],
198+
"/apigw-token-auth/DefaultTest/DeployAssert/SingletonFunction1488541a7b23466481b69b4408076b81/Role": [
199+
{
200+
"type": "aws:cdk:logicalId",
201+
"data": "SingletonFunction1488541a7b23466481b69b4408076b81Role37ABCE73"
202+
}
203+
],
204+
"/apigw-token-auth/DefaultTest/DeployAssert/SingletonFunction1488541a7b23466481b69b4408076b81/Handler": [
205+
{
206+
"type": "aws:cdk:logicalId",
207+
"data": "SingletonFunction1488541a7b23466481b69b4408076b81HandlerCD40AE9F"
208+
}
209+
],
210+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke8e1b9f979f2329abf1ed6574d33d391a/Default/Default": [
211+
{
212+
"type": "aws:cdk:logicalId",
213+
"data": "LambdaInvoke8e1b9f979f2329abf1ed6574d33d391a"
214+
}
215+
],
216+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke8e1b9f979f2329abf1ed6574d33d391a/Invoke": [
217+
{
218+
"type": "aws:cdk:logicalId",
219+
"data": "LambdaInvoke8e1b9f979f2329abf1ed6574d33d391aInvokeCCB91944"
220+
}
221+
],
222+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke8e1b9f979f2329abf1ed6574d33d391a/AssertionResults": [
223+
{
224+
"type": "aws:cdk:logicalId",
225+
"data": "AssertionResultsLambdaInvoke8e1b9f979f2329abf1ed6574d33d391a"
226+
}
227+
],
228+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke0532e3d95b2a56b147278c621e5800c4/Default/Default": [
229+
{
230+
"type": "aws:cdk:logicalId",
231+
"data": "LambdaInvoke0532e3d95b2a56b147278c621e5800c4"
232+
}
233+
],
234+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke0532e3d95b2a56b147278c621e5800c4/Invoke": [
235+
{
236+
"type": "aws:cdk:logicalId",
237+
"data": "LambdaInvoke0532e3d95b2a56b147278c621e5800c4Invoke73472D9F"
238+
}
239+
],
240+
"/apigw-token-auth/DefaultTest/DeployAssert/LambdaInvoke0532e3d95b2a56b147278c621e5800c4/AssertionResults": [
241+
{
242+
"type": "aws:cdk:logicalId",
243+
"data": "AssertionResultsLambdaInvoke0532e3d95b2a56b147278c621e5800c4"
244+
}
245+
],
246+
"/apigw-token-auth/DefaultTest/DeployAssert/BootstrapVersion": [
247+
{
248+
"type": "aws:cdk:logicalId",
249+
"data": "BootstrapVersion"
250+
}
251+
],
252+
"/apigw-token-auth/DefaultTest/DeployAssert/CheckBootstrapVersion": [
253+
{
254+
"type": "aws:cdk:logicalId",
255+
"data": "CheckBootstrapVersion"
256+
}
257+
]
258+
},
259+
"displayName": "apigw-token-auth/DefaultTest/DeployAssert"
260+
}
261+
}
262+
}

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.integ.snapshot/tree.json

+934
Large diffs are not rendered by default.

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.lit.integ.snapshot/cdk.out

-1
This file was deleted.

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.lit.integ.snapshot/integ.json

-14
This file was deleted.

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.lit.integ.snapshot/manifest.json

-124
This file was deleted.

‎packages/@aws-cdk/aws-apigateway/test/authorizers/token-authorizer.lit.integ.snapshot/tree.json

-490
This file was deleted.

‎packages/@aws-cdk/aws-apigateway/test/lambda-api.test.ts

+60
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,66 @@ describe('lambda api', () => {
270270
});
271271
});
272272

273+
test('LambdaRestApi defines a REST API with CORS enabled and defaultMethodOptions', () => {
274+
// GIVEN
275+
const stack = new cdk.Stack();
276+
277+
const handler = new lambda.Function(stack, 'handler', {
278+
handler: 'index.handler',
279+
code: lambda.Code.fromInline('boom'),
280+
runtime: lambda.Runtime.NODEJS_14_X,
281+
});
282+
283+
// WHEN
284+
new apigw.LambdaRestApi(stack, 'lambda-rest-api', {
285+
handler,
286+
defaultMethodOptions: {
287+
authorizationType: apigw.AuthorizationType.IAM,
288+
},
289+
defaultCorsPreflightOptions: {
290+
allowOrigins: ['https://aws.amazon.com'],
291+
allowMethods: ['GET', 'PUT'],
292+
},
293+
});
294+
295+
// THEN
296+
Template.fromStack(stack).hasResourceProperties('AWS::ApiGateway::Method', {
297+
HttpMethod: 'OPTIONS',
298+
ResourceId: { Ref: 'lambdarestapiproxyE3AE07E3' },
299+
AuthorizationType: 'NONE',
300+
AuthorizerId: Match.absent(),
301+
ApiKeyRequired: Match.absent(),
302+
Integration: {
303+
IntegrationResponses: [
304+
{
305+
ResponseParameters: {
306+
'method.response.header.Access-Control-Allow-Headers': "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent'",
307+
'method.response.header.Access-Control-Allow-Origin': "'https://aws.amazon.com'",
308+
'method.response.header.Vary': "'Origin'",
309+
'method.response.header.Access-Control-Allow-Methods': "'GET,PUT'",
310+
},
311+
StatusCode: '204',
312+
},
313+
],
314+
RequestTemplates: {
315+
'application/json': '{ statusCode: 200 }',
316+
},
317+
Type: 'MOCK',
318+
},
319+
MethodResponses: [
320+
{
321+
ResponseParameters: {
322+
'method.response.header.Access-Control-Allow-Headers': true,
323+
'method.response.header.Access-Control-Allow-Origin': true,
324+
'method.response.header.Vary': true,
325+
'method.response.header.Access-Control-Allow-Methods': true,
326+
},
327+
StatusCode: '204',
328+
},
329+
],
330+
});
331+
});
332+
273333
test('LambdaRestApi allows passing GENERATE_IF_NEEDED as the physical name', () => {
274334
// GIVEN
275335
const stack = new cdk.Stack();

0 commit comments

Comments
 (0)
Please sign in to comment.