SAM CORS does not create needed Method Responses

[ehorodyski]

Description:

Invalid Response status code specified when trying to apply CORS to SAM-created API gateway endpoints.

Steps to reproduce the issue:

1. Create a SAM template w/ CORS enabled
2. Deploy and have artifacts created
3. Attempt to set CORS

Observed result:

Error listed above. I think the issue is that the Method Responses that API Gateway automatically creates through the GUI when applying CORS are not being added to the endpoints that SAM creates. Therefore, when moving artifacts to another environment in a manual process (such as I have to do for my organization, we cannot use SAM to deploy Production-level artifacts) I run into the issue showed above.

Expected result:

Set endpoints correctly. Addt., why are endpoints created through SAM automatically set to use proxy-integration?

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

Output of sam --version:
0.6.0

Optional Debug logs:
Sample Template.YAML (Acct. Credentials/Role obscured for security):

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: ROLE
Globals:
    Function:
        Timeout: 300
Resources:
    MyAPI:
        Type: AWS::Serverless::Api
        Properties:
            Name: my-api
            StageName: v1
            EndpointConfiguration: EDGE
            Cors:
                AllowMethods: "'GET,POST,PUT,DELETE'"
                AllowHeaders: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'"
                AllowOrigin: "'*'"
    MyAPIFunction:
        Type: AWS::Serverless::Function
        Properties:
            FunctionName: my-api
            CodeUri: my-api-lambda/
            Handler: index.handler
            Runtime: nodejs8.10
            Role: arn:aws:iam::XXXXXX:role/role
            Description: This lambda runs functionality.
            Environment:
                Variables:
                    HIDDEN: True
            Events:
                Get:
                    Type: Api
                    Properties:
                        Path: /my/{id}
                        Method: post
                        RestApiId:
                            Ref: MyAPI
                Test:
                    Type: Api
                    Properties:
                        Path: /my/test
                        Method: post
                        RestApiId:
                            Ref: MyAPI
                Update:
                    Type: Api
                    Properties:
                        Path: /my/{id}
                        Method: put
                        RestApiId:
                            Ref: MyAPI
                Sync:
                    Type: Api
                    Properties:
                        Path: /my/sync/{id}
                        Method: get
                        RestApiId:
                            Ref: MyAPI
              

[ehorodyski]

Any news on this front? Even exporting our API and lambda to different accounts is busting...I can't recall what happened but I think the Swagger generated from the SAM template was invalid

[brettstack]

What you likely want to do is export your API from the GUI (on the Stage page) and specify that Swagger in the DefinitionBody of MyAPI

[ehorodyski]

Hi @brettstack, what I'm looking to do is avoid creating a Swagger file, or creating an API Gateway from the GUI. I'm trying to accomplish building and deploying my serverless application stack through SAM only. However, I am running into the issues above when trying to re-configure CORS, or add an API-Key.

I'm lead to believe there is something wrong either with SAM or my template, for instance, why do no Method Responses get generated for the endpoints I deploy?

[brettstack]

I see. We do have a plan for minimizing the amount of Swagger you need to write; unfortunately, for now it sounds like your only option is to define Swagger for:

1. Using API Keys
2. Using API Gateway without Lambda Proxy Integration

[ehorodyski]

@brettstack - What confuses me the most is why SAM is not creating the Method Resources. Is that by design? Is it due to my template? Again, when you create an endpoint via the GUI, the default Method Resources are created in order to set CORS on a resource. The screens I attached show that this was not possible during my deployment. It makes me feel as if I did something wrong in my SAM template.

[brettstack]

SAM CORS only creates the preflight/OPTIONS configuration for you. This is because SAM creates API proxy integrations (as you mentioned) which do not allow setting method response.

[brettstack]

I'm going to close this issue and create a new one for improving the CORS documentation.

[ehorodyski]

Thanks @brettstack. I'm still a bit confused on the error I see on the API Gateway GUI (second screenshot) -- why does API Gateway make these checks for endpoints that are Proxy Integrations?