validate Http Api Authorizers identity Header

samtranslator/model/apigatewayv2.py

@@ -172,10 +172,18 @@ def _validate_lambda_authorizer(self):
                 self.api_logical_id, f"{self.name} Lambda Authorizer must define 'AuthorizerPayloadFormatVersion'."
             )
 
-        if self.identity and not isinstance(self.identity, dict):
-            raise InvalidResourceException(
-                self.api_logical_id, f"{self.name} Lambda Authorizer property 'identity' is of invalid type."
-            )
+        if self.identity:
+            if not isinstance(self.identity, dict):
+                raise InvalidResourceException(
+                    self.api_logical_id, self.name + " Lambda Authorizer property 'identity' is of invalid type."
+                )
+            headers = self.identity.get("Headers")
+            if headers:
+                if not isinstance(headers, list) or any([not isinstance(header, str) for header in headers]):
+                    raise InvalidResourceException(
+                        self.api_logical_id,
+                        self.name + " Lambda Authorizer property identity's 'Headers' is of invalid type.",
+                    )
 
     def generate_openapi(self):
         """

tests/translator/input/error_api_authorizer_property_indentity_header_with_invalid_type.yaml

@@ -0,0 +1,58 @@
+Parameters:
+  AuthKeyName:
+    Type: String
+    Default: Auth_name
+
+Resources:
+  MyLambdaFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Handler: index.handler
+      Runtime: python3.7
+      InlineCode: |
+        def handler(event, context):
+            return {'body': 'Hello World!', 'statusCode': 200}
+      MemorySize: 128
+      Events:
+        PostApi:
+          Type: HttpApi
+          Properties:
+            Auth:
+              Authorizer: MyLambdaAuthUpdated
+            ApiId: 
+              Ref: MyApi
+            Method: POST
+            Path: /post
+
+  MyAuthFn:
+    Type: AWS::Serverless::Function
+    Properties:
+      InlineCode: |
+        print("hello")
+      Handler: index.handler
+      Runtime: nodejs12.x
+
+  MyApi:
+    Type: AWS::Serverless::HttpApi
+    Properties:
+      Tags:
+        Tag1: value1
+        Tag2: value2
+      Auth:
+        Authorizers:
+          MyLambdaAuthUpdated:
+            FunctionArn: 
+              Fn::GetAtt:
+                - MyAuthFn
+                - Arn
+            FunctionInvokeRole:
+              Fn::GetAtt:
+                - MyAuthFnRole
+                - Arn
+            Identity: 
+              Headers:
+                - Ref: AuthKeyName
+            AuthorizerPayloadFormatVersion: 1.0
+        DefaultAuthorizer: MyLambdaAuthUpdated
+
+

tests/translator/output/error_api_authorizer_property_indentity_header_with_invalid_type.json

@@ -0,0 +1,8 @@
+{
+    "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [MyApi] is invalid. MyLambdaAuthUpdated Lambda Authorizer property identity's 'Headers' is of invalid type.",
+    "errors": [
+        {
+            "errorMessage": "Resource with id [MyApi] is invalid. MyLambdaAuthUpdated Lambda Authorizer property identity's 'Headers' is of invalid type."
+        }
+    ]
+}