samtranslator produces invalid OpenAPI definition when using CORS and OpenAPI 3.0

[Dunedan]

Description:

While SAM supports adding CORS definitions to OpenAPI templates by utilizing the Cors property for AWS::Serverless::Api, it does only support it for OpenAPI 2.0. For OpenAPI 3.0 the CORS stuff gets added, but is incompatible with OpenAPI 3.0 causing the deployment to fail. That's because the structure of "operation objects" changed between OpenAPI 2.0 and OpenAPI 3.0 and SAM isn't aware of that.

Steps to reproduce the issue:

1. Create AWS::Serverless::Api resource with the Cors property set and a definition body consisting of an OpenAPI 3 definition like the following one:

  api:
    Type: 'AWS::Serverless::Api'
    Properties:
      Cors: www.example.tld
      StageName: v1
      DefinitionBody:
        openapi: 3.0.1
        info:
          version: 0.0.1
          title: example
        paths:
          /mypath:
            get:
              responses:
                '200':
                  description: Default response
              x-amazon-apigateway-integration:
                responses:
                  default:
                    statusCode: 200
                uri:
                  Fn::Sub: "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${someFunction.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy

2. Try to deploy this API.

Observed result:

Deployment fails with

Errors found during import: Unable to put integration response on 'OPTIONS' for resource at path '/mypath': Invalid mapping expression specified: Validation Result: warnings : [], errors : [Invalid mapping expression specified: mypath.test] Additionally, these warnings were found: Parse issue: attribute paths.'/mypath'(options).responses.200.Access-Control-Allow-Origin.type is unexpected Parse issue: attribute paths.'/mypath'(options).responses.200.Access-Control-Allow-Methods.type is unexpected Parse issue: attribute paths.'/mypath'(options).produces is unexpected Parse issue: attribute paths.'/mypath'(options).consumes is unexpected

Expected result:

Deployment succeeds.

[ShreyaGangishetty]

@Dunedan I have used the below template (similar to the one you posted) for recreating the issue. I was able to successfully deploy this template for swagger: 2.0 as well as for openapi: 3.0.1 without changing any other properties. Please let me know if I am missing something here.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  ApiGatewayApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: v1
      Cors: "'www.example.com'"

      DefinitionBody:
        #swagger: 2.0
        openapi: 3.0.1
        info:
          version: 0.0.1
          title: AwsSamExample
        paths:
          /mypath:
            get:
              responses:
                '200':
                  description: Default response
              x-amazon-apigateway-integration:
                responses:
                  default:
                    statusCode: 200
                uri:
                  Fn::Sub: "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${LambdaFunction.Arn}/invocations"
                passthroughBehavior: when_no_match
                httpMethod: POST
                type: aws_proxy

  LambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      InlineCode: |
        exports.handler = async (event) => {
          const response = {
            statusCode: 200,
            body: JSON.stringify('Hello from Lambda!'),
          };
          return response;
        };
      Handler: index.handler
      Runtime: nodejs10.x
      Events:
        ProxyApiRoot:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGatewayApi
            Path: /mypath
            Method: ANY

[ShreyaGangishetty]

Here is an working example for swagger: 2.0 and openapi: 3.0.1.

[ShreyaGangishetty]

@Dunedan the only difference I could see in your template is this property: Cors: www.example.tld. The property should have a single quote like this: Cors: "'www.example.tld'" and this is what causing the error in deployment. Please refer to our documentation for more information on defining Cors properties.

[Dunedan]

I haven't tried deploying the template since, but I just transformed your example with the latest samtranslator version and it's still as broken as reported. If deployment works now that's probably because the API Gateway team changed something in how API Gateway processes such broken templates.

I highlighted two of the violations of the OpenAPI 3.0 specification as inline comments in the OpenAPI part of the template after transformation with samtranslator:

openapi: 3.0.1
info:
  version: '0.0.1'
  title: AwsSamExample
paths:
  /mypath:
    get:
      responses:
        '200':
          description: Default response
      x-amazon-apigateway-integration:
        responses:
          default:
            statusCode: 200
        uri: !Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${LambdaFunction.Arn}/invocations'
        passthroughBehavior: when_no_match
        httpMethod: POST
        type: aws_proxy
    options:
      summary: CORS support
      consumes:    # <- not allowed according to OpenAPI 3.0
        - application/json
      produces:    # <- not allowed according to OpenAPI 3.0
        - application/json
      x-amazon-apigateway-integration:
        type: mock
        requestTemplates:
          application/json: "{\n  \"statusCode\" : 200\n}\n"
        responses:
          default:
            statusCode: '200'
            responseParameters:
              method.response.header.Access-Control-Allow-Origin: '''www.example.com'''
              method.response.header.Access-Control-Allow-Methods: '''GET,OPTIONS'''
            responseTemplates:
              application/json: "{}\n"
      responses:
        '200':
          description: Default response for CORS method
          headers:
            Access-Control-Allow-Origin:
              type: string    # <- not allowed according to OpenAPI 3.0
            Access-Control-Allow-Methods:
              type: string    # <- not allowed according to OpenAPI 3.0

[ShreyaGangishetty]

@Dunedan Thank you for bringing this! I have submitted a PR to remove consumes and produces for openapi3.0. I just verified that for headers it needs to be as below:

          headers:
            Access-Control-Allow-Origin:
              schema:
                type: string
            Access-Control-Allow-Methods:
              schema:
                type: string

I will send a PR for this as well

[paul-uz]

@ShreyaGangishetty i am getting a similar error still using OpenAPI 3.0.1 for my options path:

            options:
              parameters:
              - name: "videoID"
                in: "path"
                required: true
                schema:
                  type: "string"
              responses:
                "200":
                  description: "200 response"
                  headers:
                    Access-Control-Allow-Origin:
                      schema:
                        type: "string"
                    Access-Control-Allow-Methods:
                      schema:
                        type: "string"
                    Access-Control-Allow-Headers:
                      schema:
                        type: "string"

I get this error in cloudformation:

Errors found during import: Unable to put integration on 'GET' for resource at path '/videos/{videoID}': Invalid ARN specified in the request Unable to put integration on 'PATCH' for resource at path '/videos/{videoID}': Invalid ARN specified in the request Additionally, these warnings were found: Parse issue: attribute paths.'/videos/{videoID}'(options).responses.200.Access-Control-Allow-Origin.schema is unexpected Parse issue: attribute paths.'/videos/{videoID}'(options).responses.200.Access-Control-Allow-Methods.schema is unexpected Parse issue: attribute paths.'/videos/{videoID}'(options).responses.200.Access-Control-Allow-Headers.schema is unexpected

[mpinto1991]

@ShreyaGangishetty i am getting a similar error still using OpenAPI 3.0.1 for my options path:

            options:
              parameters:
              - name: "videoID"
                in: "path"
                required: true
                schema:
                  type: "string"
              responses:
                "200":
                  description: "200 response"
                  headers:
                    Access-Control-Allow-Origin:
                      schema:
                        type: "string"
                    Access-Control-Allow-Methods:
                      schema:
                        type: "string"
                    Access-Control-Allow-Headers:
                      schema:
                        type: "string"

I get this error in cloudformation:

Errors found during import: Unable to put integration on 'GET' for resource at path '/videos/{videoID}': Invalid ARN specified in the request Unable to put integration on 'PATCH' for resource at path '/videos/{videoID}': Invalid ARN specified in the request Additionally, these warnings were found: Parse issue: attribute paths.'/videos/{videoID}'(options).responses.200.Access-Control-Allow-Origin.schema is unexpected Parse issue: attribute paths.'/videos/{videoID}'(options).responses.200.Access-Control-Allow-Methods.schema is unexpected Parse issue: attribute paths.'/videos/{videoID}'(options).responses.200.Access-Control-Allow-Headers.schema is unexpected

did you solve it?