Skip to content

Commit 5d2896b

Browse files
jfussjfuss
committed
Revert "Revert "Issue 1508 remove check requiring identity ... (aws#1577)" (aws#2038)"
This reverts commit ed3c283.
1 parent f313094 commit 5d2896b

File tree

5 files changed

+240
-29
lines changed

5 files changed

+240
-29
lines changed

‎samtranslator/model/apigateway.py‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -270,8 +270,9 @@ def _is_missing_identity_source(self, identity):
270270
query_strings = identity.get("QueryStrings")
271271
stage_variables = identity.get("StageVariables")
272272
context = identity.get("Context")
273+
ttl = identity.get("ReauthorizeEvery")
273274

274-
if not headers and not query_strings and not stage_variables and not context:
275+
if (ttl is None or int(ttl) > 0) and not headers and not query_strings and not stage_variables and not context:
275276
return True
276277

277278
return False
@@ -314,7 +315,9 @@ def generate_swagger(self):
314315
swagger[APIGATEWAY_AUTHORIZER_KEY]["authorizerCredentials"] = function_invoke_role
315316

316317
if self._get_function_payload_type() == "REQUEST":
317-
swagger[APIGATEWAY_AUTHORIZER_KEY]["identitySource"] = self._get_identity_source()
318+
identity_source = self._get_identity_source()
319+
if identity_source:
320+
swagger[APIGATEWAY_AUTHORIZER_KEY]["identitySource"] = self._get_identity_source()
318321

319322
# Authorizer Validation Expression is only allowed on COGNITO_USER_POOLS and LAMBDA_TOKEN
320323
is_lambda_token_authorizer = authorizer_type == "LAMBDA" and self._get_function_payload_type() == "TOKEN"

‎tests/model/test_api.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,18 @@ def test_create_authorizer_fails_with_string_authorization_scopes(self):
1717
auth = ApiGatewayAuthorizer(
1818
api_logical_id="logicalId", name="authName", authorization_scopes="invalid_scope"
1919
)
20+
21+
def test_create_authorizer_fails_with_missing_identity_values_and_not_cached(self):
22+
with pytest.raises(InvalidResourceException):
23+
auth = ApiGatewayAuthorizer(
24+
api_logical_id="logicalId",
25+
name="authName",
26+
identity={"ReauthorizeEvery": 10},
27+
function_payload_type="REQUEST",
28+
)
29+
30+
def test_create_authorizer_fails_with_empty_identity(self):
31+
with pytest.raises(InvalidResourceException):
32+
auth = ApiGatewayAuthorizer(
33+
api_logical_id="logicalId", name="authName", identity={}, function_payload_type="REQUEST"
34+
)

‎tests/translator/input/api_with_auth_all_minimum.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,20 @@ Resources:
3232
Identity:
3333
Headers:
3434
- Authorization1
35+
36+
MyApiWithNotCachedLambdaRequestAuth:
37+
Type: "AWS::Serverless::Api"
38+
Properties:
39+
StageName: Prod
40+
Auth:
41+
DefaultAuthorizer: MyLambdaRequestAuth
42+
Authorizers:
43+
MyLambdaRequestAuth:
44+
FunctionPayloadType: REQUEST
45+
FunctionArn: !GetAtt MyAuthFn.Arn
46+
Identity:
47+
ReauthorizeEvery: 0
48+
3549
MyAuthFn:
3650
Type: AWS::Serverless::Function
3751
Properties:
@@ -81,6 +95,13 @@ Resources:
8195
RestApiId: !Ref MyApiWithLambdaRequestAuth
8296
Method: any
8397
Path: /any/lambda-request
98+
LambdaNotCachedRequest:
99+
Type: Api
100+
Properties:
101+
RestApiId: !Ref MyApiWithNotCachedLambdaRequestAuth
102+
Method: get
103+
Path: /not-cached-lambda-request
104+
84105
MyUserPool:
85106
Type: AWS::Cognito::UserPool
86107
Properties:

‎tests/translator/output/api_with_auth_all_minimum.json‎

Lines changed: 51 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
]
6565
},
6666
"ManagedPolicyArns": [
67-
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
67+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
6868
],
6969
"Tags": [
7070
{
@@ -117,7 +117,7 @@
117117
]
118118
},
119119
"ManagedPolicyArns": [
120-
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
120+
"arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
121121
],
122122
"Tags": [
123123
{
@@ -137,7 +137,7 @@
137137
"Principal": "apigateway.amazonaws.com",
138138
"SourceArn": {
139139
"Fn::Sub": [
140-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/*/any/cognito",
140+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/*/any/cognito",
141141
{
142142
"__ApiId__": {
143143
"Ref": "MyApiWithCognitoAuth"
@@ -158,7 +158,7 @@
158158
"Principal": "apigateway.amazonaws.com",
159159
"SourceArn": {
160160
"Fn::Sub": [
161-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/*/any/lambda-request",
161+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/*/any/lambda-request",
162162
{
163163
"__ApiId__": {
164164
"Ref": "MyApiWithLambdaRequestAuth"
@@ -179,7 +179,7 @@
179179
"Principal": "apigateway.amazonaws.com",
180180
"SourceArn": {
181181
"Fn::Sub": [
182-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/*/any/lambda-token",
182+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/*/any/lambda-token",
183183
{
184184
"__ApiId__": {
185185
"Ref": "MyApiWithLambdaTokenAuth"
@@ -200,7 +200,7 @@
200200
"Principal": "apigateway.amazonaws.com",
201201
"SourceArn": {
202202
"Fn::Sub": [
203-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognito",
203+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognito",
204204
{
205205
"__ApiId__": {
206206
"Ref": "MyApiWithCognitoAuth"
@@ -221,7 +221,7 @@
221221
"Principal": "apigateway.amazonaws.com",
222222
"SourceArn": {
223223
"Fn::Sub": [
224-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/lambda-request",
224+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/lambda-request",
225225
{
226226
"__ApiId__": {
227227
"Ref": "MyApiWithLambdaRequestAuth"
@@ -242,7 +242,7 @@
242242
"Principal": "apigateway.amazonaws.com",
243243
"SourceArn": {
244244
"Fn::Sub": [
245-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/lambda-token",
245+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/lambda-token",
246246
{
247247
"__ApiId__": {
248248
"Ref": "MyApiWithLambdaTokenAuth"
@@ -271,7 +271,7 @@
271271
"type": "aws_proxy",
272272
"httpMethod": "POST",
273273
"uri": {
274-
"Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
274+
"Fn::Sub": "arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
275275
}
276276
},
277277
"responses": {},
@@ -288,7 +288,7 @@
288288
"type": "aws_proxy",
289289
"httpMethod": "POST",
290290
"uri": {
291-
"Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
291+
"Fn::Sub": "arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
292292
}
293293
},
294294
"responses": {},
@@ -319,13 +319,21 @@
319319
}
320320
}
321321
}
322+
},
323+
"Parameters": {
324+
"endpointConfigurationTypes": "REGIONAL"
325+
},
326+
"EndpointConfiguration": {
327+
"Types": [
328+
"REGIONAL"
329+
]
322330
}
323331
}
324332
},
325-
"MyApiWithCognitoAuthDeploymentdcc28e4b5f": {
333+
"MyApiWithCognitoAuthDeployment5d6fbaaea5": {
326334
"Type": "AWS::ApiGateway::Deployment",
327335
"Properties": {
328-
"Description": "RestApi deployment id: dcc28e4b5f8fbdb114c4da86eae5deddc368c60e",
336+
"Description": "RestApi deployment id: 5d6fbaaea5286fd32d64239db8b7f2247cb3f2b5",
329337
"RestApiId": {
330338
"Ref": "MyApiWithCognitoAuth"
331339
},
@@ -336,7 +344,7 @@
336344
"Type": "AWS::ApiGateway::Stage",
337345
"Properties": {
338346
"DeploymentId": {
339-
"Ref": "MyApiWithCognitoAuthDeploymentdcc28e4b5f"
347+
"Ref": "MyApiWithCognitoAuthDeployment5d6fbaaea5"
340348
},
341349
"RestApiId": {
342350
"Ref": "MyApiWithCognitoAuth"
@@ -362,7 +370,7 @@
362370
"type": "aws_proxy",
363371
"httpMethod": "POST",
364372
"uri": {
365-
"Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
373+
"Fn::Sub": "arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
366374
}
367375
},
368376
"responses": {},
@@ -379,7 +387,7 @@
379387
"type": "aws_proxy",
380388
"httpMethod": "POST",
381389
"uri": {
382-
"Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
390+
"Fn::Sub": "arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
383391
}
384392
},
385393
"responses": {},
@@ -401,7 +409,7 @@
401409
"type": "token",
402410
"authorizerUri": {
403411
"Fn::Sub": [
404-
"arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${__FunctionArn__}/invocations",
412+
"arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${__FunctionArn__}/invocations",
405413
{
406414
"__FunctionArn__": {
407415
"Fn::GetAtt": [
@@ -415,13 +423,21 @@
415423
}
416424
}
417425
}
426+
},
427+
"Parameters": {
428+
"endpointConfigurationTypes": "REGIONAL"
429+
},
430+
"EndpointConfiguration": {
431+
"Types": [
432+
"REGIONAL"
433+
]
418434
}
419435
}
420436
},
421-
"MyApiWithLambdaTokenAuthDeployment03cc3fd4fd": {
437+
"MyApiWithLambdaTokenAuthDeployment79a03805ba": {
422438
"Type": "AWS::ApiGateway::Deployment",
423439
"Properties": {
424-
"Description": "RestApi deployment id: 03cc3fd4fd00e795fb067f94da06cb2fcfe95d3b",
440+
"Description": "RestApi deployment id: 79a03805ba3abc1f005e1282f19bb79af68b4f96",
425441
"RestApiId": {
426442
"Ref": "MyApiWithLambdaTokenAuth"
427443
},
@@ -432,7 +448,7 @@
432448
"Type": "AWS::ApiGateway::Stage",
433449
"Properties": {
434450
"DeploymentId": {
435-
"Ref": "MyApiWithLambdaTokenAuthDeployment03cc3fd4fd"
451+
"Ref": "MyApiWithLambdaTokenAuthDeployment79a03805ba"
436452
},
437453
"RestApiId": {
438454
"Ref": "MyApiWithLambdaTokenAuth"
@@ -453,7 +469,7 @@
453469
"Principal": "apigateway.amazonaws.com",
454470
"SourceArn": {
455471
"Fn::Sub": [
456-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/authorizers/*",
472+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/authorizers/*",
457473
{
458474
"__ApiId__": {
459475
"Ref": "MyApiWithLambdaTokenAuth"
@@ -481,7 +497,7 @@
481497
"type": "aws_proxy",
482498
"httpMethod": "POST",
483499
"uri": {
484-
"Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
500+
"Fn::Sub": "arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
485501
}
486502
},
487503
"responses": {},
@@ -498,7 +514,7 @@
498514
"type": "aws_proxy",
499515
"httpMethod": "POST",
500516
"uri": {
501-
"Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
517+
"Fn::Sub": "arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations"
502518
}
503519
},
504520
"responses": {},
@@ -520,7 +536,7 @@
520536
"type": "request",
521537
"authorizerUri": {
522538
"Fn::Sub": [
523-
"arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${__FunctionArn__}/invocations",
539+
"arn:aws-cn:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${__FunctionArn__}/invocations",
524540
{
525541
"__FunctionArn__": {
526542
"Fn::GetAtt": [
@@ -535,13 +551,21 @@
535551
}
536552
}
537553
}
554+
},
555+
"Parameters": {
556+
"endpointConfigurationTypes": "REGIONAL"
557+
},
558+
"EndpointConfiguration": {
559+
"Types": [
560+
"REGIONAL"
561+
]
538562
}
539563
}
540564
},
541-
"MyApiWithLambdaRequestAuthDeployment6a32cc7f63": {
565+
"MyApiWithLambdaRequestAuthDeployment12aa7114ad": {
542566
"Type": "AWS::ApiGateway::Deployment",
543567
"Properties": {
544-
"Description": "RestApi deployment id: 6a32cc7f63485b93190f441a47da57f43de6a532",
568+
"Description": "RestApi deployment id: 12aa7114ad8cd8aaeffd832e49f6f8aa8b6c2062",
545569
"RestApiId": {
546570
"Ref": "MyApiWithLambdaRequestAuth"
547571
},
@@ -552,7 +576,7 @@
552576
"Type": "AWS::ApiGateway::Stage",
553577
"Properties": {
554578
"DeploymentId": {
555-
"Ref": "MyApiWithLambdaRequestAuthDeployment6a32cc7f63"
579+
"Ref": "MyApiWithLambdaRequestAuthDeployment12aa7114ad"
556580
},
557581
"RestApiId": {
558582
"Ref": "MyApiWithLambdaRequestAuth"
@@ -573,7 +597,7 @@
573597
"Principal": "apigateway.amazonaws.com",
574598
"SourceArn": {
575599
"Fn::Sub": [
576-
"arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/authorizers/*",
600+
"arn:aws-cn:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/authorizers/*",
577601
{
578602
"__ApiId__": {
579603
"Ref": "MyApiWithLambdaRequestAuth"

0 commit comments

Comments
 (0)