Skip to content

fix: allow setting InvokeRole to NONE or null #986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 26, 2019
Merged

fix: allow setting InvokeRole to NONE or null #986

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d742de6
Allow setting InvokeRole to NONE or null
keetonian Jun 19, 2019
6de086e
Update tests
keetonian Jun 25, 2019
2b930e2
Updated example comment
keetonian Jul 23, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion examples/2016-10-31/api_aws_iam_auth/template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ Resources:
StageName: Prod
Auth:
DefaultAuthorizer: AWS_IAM
InvokeRole: CALLER_CREDENTIALS
InvokeRole: CALLER_CREDENTIALS # default, can specify other role or NONE

MyFunction:
Type: AWS::Serverless::Function
Expand Down
14 changes: 11 additions & 3 deletions samtranslator/swagger/swagger.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,10 +169,18 @@ def add_lambda_integration(self, path, method, integration_uri,
api_auth_config = api_auth_config or {}
if method_auth_config.get('Authorizer') == 'AWS_IAM' \
or api_auth_config.get('DefaultAuthorizer') == 'AWS_IAM' and not method_auth_config:
self.paths[path][method][self._X_APIGW_INTEGRATION]['credentials'] = self._generate_integration_credentials(
method_invoke_role=method_auth_config.get('InvokeRole'),
api_invoke_role=api_auth_config.get('InvokeRole')
method_invoke_role = method_auth_config.get('InvokeRole')
if not method_invoke_role and 'InvokeRole' in method_auth_config:
method_invoke_role = 'NONE'
api_invoke_role = api_auth_config.get('InvokeRole')
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section looks for two things:

  • If there is an InvokeRole set, it gets the value
  • If InvokeRole is set to null, it sets it to 'NONE'
  • If InvokeRole is not set, it is passed as usual and is set to CallerCredentials.

if not api_invoke_role and 'InvokeRole' in api_auth_config:
api_invoke_role = 'NONE'
credentials = self._generate_integration_credentials(
method_invoke_role=method_invoke_role,
api_invoke_role=api_invoke_role
)
if credentials and credentials != 'NONE':
self.paths[path][method][self._X_APIGW_INTEGRATION]['credentials'] = credentials

# If 'responses' key is *not* present, add it with an empty dict as value
path_dict[method].setdefault('responses', {})
Expand Down
68 changes: 68 additions & 0 deletions tests/translator/input/api_with_aws_iam_auth_overrides.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,11 @@
Resources:
MyApiWithAwsIamAuthNoCallerCredentials:
Type: "AWS::Serverless::Api"
Properties:
StageName: Prod
Auth:
DefaultAuthorizer: AWS_IAM
InvokeRole: NONE
MyApiWithAwsIamAuth:
Type: "AWS::Serverless::Api"
Properties:
Expand Down Expand Up @@ -84,3 +91,64 @@ Resources:
Auth:
Authorizer: AWS_IAM
InvokeRole: arn:aws:iam::456::role/something-else
MyFunctionNONEInvokeRole:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://bucket/key
Handler: index.handler
Runtime: nodejs8.10
Events:
API3:
Type: Api
Properties:
RestApiId: !Ref MyApiWithAwsIamAuth
Method: get
Path: /MyFunctionNONEInvokeRole
Auth:
Authorizer: AWS_IAM
InvokeRole: NONE
MyFunctionNullInvokeRole:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://bucket/key
Handler: index.handler
Runtime: nodejs8.10
Events:
API3:
Type: Api
Properties:
RestApiId: !Ref MyApiWithAwsIamAuth
Method: get
Path: /MyFunctionNullInvokeRole
Auth:
Authorizer: AWS_IAM
InvokeRole: null
MyFunctionCallerCredentialsOverride:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://bucket/key
Handler: index.handler
Runtime: nodejs8.10
Events:
API3:
Type: Api
Properties:
RestApiId: !Ref MyApiWithAwsIamAuthNoCallerCredentials
Method: get
Path: /
Auth:
Authorizer: AWS_IAM
InvokeRole: CALLER_CREDENTIALS
MyFunctionNoCallerCredentials:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://bucket/key
Handler: index.handler
Runtime: nodejs8.10
Events:
API3:
Type: Api
Properties:
RestApiId: !Ref MyApiWithAwsIamAuthNoCallerCredentials
Method: post
Path: /
Loading