Skip to content

Commit d5d7f94

Browse files
ethanmillsethanmills
committed
Allow explicit AWS::NoValue for Api and HttpApi Gateway Default Authorizer
Use AWS::NoValue rather than NONE to preserve backwards compatibility with any templates that have authorizers named NONE
1 parent 9074ad0 commit d5d7f94

22 files changed

+6762
-11
lines changed

‎samtranslator/internal/schema_source/aws_serverless_api.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
PassThroughProp,
1212
ResourceAttributes,
1313
SamIntrinsicable,
14+
SamIntrinsicableOrNoValue,
1415
get_prop,
1516
passthrough_prop,
1617
)
@@ -119,7 +120,7 @@ class Auth(BaseModel):
119120
],
120121
]
121122
] = auth("Authorizers")
122-
DefaultAuthorizer: Optional[str] = auth("DefaultAuthorizer")
123+
DefaultAuthorizer: Optional[SamIntrinsicableOrNoValue[str]] = auth("DefaultAuthorizer")
123124
InvokeRole: Optional[str] = auth("InvokeRole")
124125
ResourcePolicy: Optional[ResourcePolicy] = auth("ResourcePolicy")
125126
UsagePlan: Optional[UsagePlan] = auth("UsagePlan")

‎samtranslator/internal/schema_source/aws_serverless_httpapi.py

+2-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
PassThroughProp,
1212
ResourceAttributes,
1313
SamIntrinsicable,
14+
SamIntrinsicableOrNoValue,
1415
get_prop,
1516
)
1617

@@ -62,7 +63,7 @@ class Auth(BaseModel):
6263
],
6364
]
6465
] = auth("Authorizers")
65-
DefaultAuthorizer: Optional[str] = auth("DefaultAuthorizer")
66+
DefaultAuthorizer: Optional[SamIntrinsicableOrNoValue[str]] = auth("DefaultAuthorizer")
6667
EnableIamAuthorizer: Optional[bool] = auth("EnableIamAuthorizer")
6768

6869

‎samtranslator/internal/schema_source/common.py

+2
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ class PassThroughProp(pydantic.BaseModel):
2323
T = TypeVar("T")
2424
SamIntrinsicable = Union[Dict[str, Any], T]
2525
SamIntrinsic = Dict[str, Any]
26+
SamIntrinsicNoValue = Dict[Literal["Ref"], Literal["AWS::NoValue"]]
27+
SamIntrinsicableOrNoValue = Union[SamIntrinsicNoValue, T]
2628

2729
# TODO: Get rid of this in favor of proper types
2830
Unknown = Optional[Any]

‎samtranslator/model/api/api_generator.py

+4-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
InvalidResourceException,
2424
InvalidTemplateException,
2525
)
26-
from samtranslator.model.intrinsics import fnGetAtt, fnSub, is_intrinsic, make_or_condition, ref
26+
from samtranslator.model.intrinsics import fnGetAtt, fnSub, is_intrinsic, is_intrinsic_no_value, make_or_condition, ref
2727
from samtranslator.model.lambda_ import LambdaPermission
2828
from samtranslator.model.route53 import Route53RecordSetGroup
2929
from samtranslator.model.s3_utils.uri_parser import parse_s3_uri
@@ -1291,6 +1291,9 @@ def _set_default_authorizer(
12911291
if not default_authorizer:
12921292
return
12931293

1294+
if is_intrinsic_no_value(default_authorizer):
1295+
return
1296+
12941297
if not isinstance(default_authorizer, str):
12951298
raise InvalidResourceException(
12961299
self.logical_id,

‎samtranslator/schema/schema.json

+30-4
Original file line numberDiff line numberDiff line change
@@ -251687,9 +251687,22 @@
251687251687
"type": "object"
251688251688
},
251689251689
"DefaultAuthorizer": {
251690+
"anyOf": [
251691+
{
251692+
"additionalProperties": {
251693+
"enum": [
251694+
"AWS::NoValue"
251695+
],
251696+
"type": "string"
251697+
},
251698+
"type": "object"
251699+
},
251700+
{
251701+
"type": "string"
251702+
}
251703+
],
251690251704
"markdownDescription": "Specify a default authorizer for an API Gateway API, which will be used for authorizing API calls by default\\. \nIf the Api EventSource for the function associated with this API is configured to use IAM Permissions, then this property must be set to `AWS_IAM`, otherwise an error will result\\.\n*Type*: String \n*Required*: No \n*Default*: None \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",
251691-
"title": "DefaultAuthorizer",
251692-
"type": "string"
251705+
"title": "DefaultAuthorizer"
251693251706
},
251694251707
"InvokeRole": {
251695251708
"markdownDescription": "Sets integration credentials for all resources and methods to this value\\. \n`CALLER_CREDENTIALS` maps to `arn:aws:iam::*:user/*`, which uses the caller credentials to invoke the endpoint\\. \n*Valid values*: `CALLER_CREDENTIALS`, `NONE`, `IAMRoleArn` \n*Type*: String \n*Required*: No \n*Default*: `CALLER_CREDENTIALS` \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",
@@ -254150,9 +254163,22 @@
254150254163
"type": "object"
254151254164
},
254152254165
"DefaultAuthorizer": {
254166+
"anyOf": [
254167+
{
254168+
"additionalProperties": {
254169+
"enum": [
254170+
"AWS::NoValue"
254171+
],
254172+
"type": "string"
254173+
},
254174+
"type": "object"
254175+
},
254176+
{
254177+
"type": "string"
254178+
}
254179+
],
254153254180
"markdownDescription": "Specify the default authorizer to use for authorizing API calls to your API Gateway API\\. You can specify `AWS_IAM` as a default authorizer if `EnableIamAuthorizer` is set to `true`\\. Otherwise, specify an authorizer that you've defined in `Authorizers`\\. \n*Type*: String \n*Required*: No \n*Default*: None \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",
254154-
"title": "DefaultAuthorizer",
254155-
"type": "string"
254181+
"title": "DefaultAuthorizer"
254156254182
},
254157254183
"EnableIamAuthorizer": {
254158254184
"markdownDescription": "Specify whether to use IAM authorization for the API route\\. \n*Type*: Boolean \n*Required*: No \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",

‎schema_source/sam.schema.json

+30-4
Original file line numberDiff line numberDiff line change
@@ -3438,9 +3438,22 @@
34383438
"type": "object"
34393439
},
34403440
"DefaultAuthorizer": {
3441+
"anyOf": [
3442+
{
3443+
"additionalProperties": {
3444+
"enum": [
3445+
"AWS::NoValue"
3446+
],
3447+
"type": "string"
3448+
},
3449+
"type": "object"
3450+
},
3451+
{
3452+
"type": "string"
3453+
}
3454+
],
34413455
"markdownDescription": "Specify a default authorizer for an API Gateway API, which will be used for authorizing API calls by default\\. \nIf the Api EventSource for the function associated with this API is configured to use IAM Permissions, then this property must be set to `AWS_IAM`, otherwise an error will result\\.\n*Type*: String \n*Required*: No \n*Default*: None \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",
3442-
"title": "DefaultAuthorizer",
3443-
"type": "string"
3456+
"title": "DefaultAuthorizer"
34443457
},
34453458
"InvokeRole": {
34463459
"markdownDescription": "Sets integration credentials for all resources and methods to this value\\. \n`CALLER_CREDENTIALS` maps to `arn:aws:iam::*:user/*`, which uses the caller credentials to invoke the endpoint\\. \n*Valid values*: `CALLER_CREDENTIALS`, `NONE`, `IAMRoleArn` \n*Type*: String \n*Required*: No \n*Default*: `CALLER_CREDENTIALS` \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",
@@ -6639,9 +6652,22 @@
66396652
"type": "object"
66406653
},
66416654
"DefaultAuthorizer": {
6655+
"anyOf": [
6656+
{
6657+
"additionalProperties": {
6658+
"enum": [
6659+
"AWS::NoValue"
6660+
],
6661+
"type": "string"
6662+
},
6663+
"type": "object"
6664+
},
6665+
{
6666+
"type": "string"
6667+
}
6668+
],
66426669
"markdownDescription": "Specify the default authorizer to use for authorizing API calls to your API Gateway API\\. You can specify `AWS_IAM` as a default authorizer if `EnableIamAuthorizer` is set to `true`\\. Otherwise, specify an authorizer that you've defined in `Authorizers`\\. \n*Type*: String \n*Required*: No \n*Default*: None \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",
6643-
"title": "DefaultAuthorizer",
6644-
"type": "string"
6670+
"title": "DefaultAuthorizer"
66456671
},
66466672
"EnableIamAuthorizer": {
66476673
"markdownDescription": "Specify whether to use IAM authorization for the API route\\. \n*Type*: Boolean \n*Required*: No \n*AWS CloudFormation compatibility*: This property is unique to AWS SAM and doesn't have an AWS CloudFormation equivalent\\.",

‎tests/translator/input/api_with_auth_explicit_inline_no_default.yaml

+144
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
Resources:
2+
MyApiWithCognitoAuth:
3+
Type: AWS::Serverless::Api
4+
Properties:
5+
StageName: Prod
6+
Auth:
7+
DefaultAuthorizer: !Ref AWS::NoValue
8+
Authorizers:
9+
MyCognitoAuth:
10+
UserPoolArn: !GetAtt MyUserPool.Arn
11+
12+
MyApiWithLambdaTokenAuth:
13+
Type: AWS::Serverless::Api
14+
Properties:
15+
StageName: Prod
16+
Auth:
17+
DefaultAuthorizer: !Ref AWS::NoValue
18+
Authorizers:
19+
MyLambdaTokenAuth:
20+
FunctionArn: !GetAtt MyAuthFn.Arn
21+
22+
MyApiWithLambdaRequestAuth:
23+
Type: AWS::Serverless::Api
24+
Properties:
25+
StageName: Prod
26+
Auth:
27+
DefaultAuthorizer: !Ref AWS::NoValue
28+
Authorizers:
29+
MyLambdaRequestAuth:
30+
FunctionPayloadType: REQUEST
31+
FunctionArn: !GetAtt MyAuthFn.Arn
32+
Identity:
33+
Headers:
34+
- Authorization1
35+
MyAuthFn:
36+
Type: AWS::Serverless::Function
37+
Properties:
38+
CodeUri: s3://bucket/key
39+
Handler: index.handler
40+
Runtime: nodejs12.x
41+
MyFn:
42+
Type: AWS::Serverless::Function
43+
Properties:
44+
CodeUri: s3://bucket/key
45+
Handler: index.handler
46+
Runtime: nodejs12.x
47+
Events:
48+
CognitoNoAuth:
49+
Type: Api
50+
Properties:
51+
RestApiId: !Ref MyApiWithCognitoAuth
52+
Method: get
53+
Path: /cognito/no-auth
54+
CognitoNoAuthAnyMethod:
55+
Type: Api
56+
Properties:
57+
RestApiId: !Ref MyApiWithCognitoAuth
58+
Method: any
59+
Path: /cognito/any/no-auth
60+
Cognito:
61+
Type: Api
62+
Properties:
63+
RestApiId: !Ref MyApiWithCognitoAuth
64+
Method: get
65+
Path: /any/cognito
66+
Auth:
67+
Authorizer: MyCognitoAuth
68+
CognitoAnyMethod:
69+
Type: Api
70+
Properties:
71+
RestApiId: !Ref MyApiWithCognitoAuth
72+
Method: any
73+
Path: /any/cognito
74+
Auth:
75+
Authorizer: MyCognitoAuth
76+
LambdaTokenNoAuth:
77+
Type: Api
78+
Properties:
79+
RestApiId: !Ref MyApiWithLambdaTokenAuth
80+
Method: get
81+
Path: /lambda-token/no-auth
82+
LambdaTokenNoAuthAnyMethod:
83+
Type: Api
84+
Properties:
85+
RestApiId: !Ref MyApiWithLambdaTokenAuth
86+
Method: any
87+
Path: /lambda-token/any/no-auth
88+
LambdaToken:
89+
Type: Api
90+
Properties:
91+
RestApiId: !Ref MyApiWithLambdaTokenAuth
92+
Method: get
93+
Path: /lambda-token
94+
Auth:
95+
Authorizer: MyLambdaTokenAuth
96+
LambdaTokenAnyMethod:
97+
Type: Api
98+
Properties:
99+
RestApiId: !Ref MyApiWithLambdaTokenAuth
100+
Method: any
101+
Path: /any/lambda-token
102+
Auth:
103+
Authorizer: MyLambdaTokenAuth
104+
LambdaRequestNoAuth:
105+
Type: Api
106+
Properties:
107+
RestApiId: !Ref MyApiWithLambdaRequestAuth
108+
Method: get
109+
Path: /lambda-request/no-auth
110+
LambdaRequestNoAuthAnyMethod:
111+
Type: Api
112+
Properties:
113+
RestApiId: !Ref MyApiWithLambdaRequestAuth
114+
Method: any
115+
Path: /lambda-request/any/no-auth
116+
LambdaRequest:
117+
Type: Api
118+
Properties:
119+
RestApiId: !Ref MyApiWithLambdaRequestAuth
120+
Method: get
121+
Path: /lambda-request
122+
Auth:
123+
Authorizer: MyLambdaRequestAuth
124+
LambdaRequestAnyMethod:
125+
Type: Api
126+
Properties:
127+
RestApiId: !Ref MyApiWithLambdaRequestAuth
128+
Method: any
129+
Path: /any/lambda-request
130+
Auth:
131+
Authorizer: MyLambdaRequestAuth
132+
MyUserPool:
133+
Type: AWS::Cognito::UserPool
134+
Properties:
135+
UserPoolName: UserPoolName
136+
Policies:
137+
PasswordPolicy:
138+
MinimumLength: 8
139+
UsernameAttributes:
140+
- email
141+
Schema:
142+
- AttributeDataType: String
143+
Name: email
144+
Required: false

0 commit comments

Comments
 (0)