How can I get the arn to fill in the openapi.yaml template? CDK OpenAPI and Cognito with OpenApiGatewayToLambda

[mawilsn]

I made a small CDK project in python that uses cognito userpools and openapi. As of right now, I can get the project to work when I have a valid user pool arn . However, I want the project to fill in the template with the correct arn, so I don't have to make a user pool and then go back and fill it in.

I found an example on stackoverflow that suggests using the logical id found in the template - !GetAtt CognitoUserPool.Arn.

I renamed the logical id to coogneeto in the code and added it to the template. I pasted examples below of changing the logical id and somethings I tried in the openapi.yaml.

pool = cognito.UserPool(self, id="testpoolusercognitoid")
pool.node.default_child.override_logical_id("coogneeto") 

openapi.yaml

components:
  securitySchemes:
    CognitoAuthorizer:
      type: "apiKey"
      name: "Authorization"
      in: "header"
      x-amazon-apigateway-authtype: "cognito_user_pools"
      x-amazon-apigateway-authorizer:
        type: "cognito_user_pools"
        providerARNs:
          - arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id} # works when the the variables have the correct value
          - {coogneeto.Arn} # failed
          # - ${coogneeto.Arn} # failed
         # - !GetAtt coogneeto.Arn # failed

Still everything fails when I run it.

Below is my code.

• cdk construct

from aws_solutions_constructs.aws_openapigateway_lambda import OpenApiGatewayToLambda, ApiIntegration

from aws_cdk import (
    Duration,
    Stack,
    aws_apigateway as apigateway,
    aws_cognito as cognito,
    aws_lambda_python_alpha as lambda_python,
    aws_lambda as _lambda,
    aws_s3_assets as s3_assets,

)

class CognitoOpenapiStackStack(Stack):

    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        lambda_basic = lambda_python.PythonFunction(self,
                                    id="testlambda",
                                    entry="lambdas/test",
                                    handler="handler",
                                    index="index.py",
                                    timeout=Duration.seconds(30),
                                    runtime=_lambda.Runtime.PYTHON_3_11
                                    )
                                    
        pool = cognito.UserPool(self, id="testpoolusercognitoid")
        pool.node.default_child.override_logical_id("coogneeto") 
        # This is probably useful. It changes the logical id in the template file.
        # This change allows it to be called consistently in template.
        # ${coogneeto.Arn}
        # However, this doesn't seem to work

        full_scope = cognito.ResourceServerScope(scope_name="*", 
											scope_description="Full Access")
                                            
        user_server = pool.add_resource_server(id="ResourceServer",
                                                identifier="users",
                                                scopes=[full_scope]
                                                    )

        pool.add_domain(id="testDom", cognito_domain=cognito.CognitoDomainOptions(
            domain_prefix="testdomainauthtestingforqualys"
                 ))
                 
        pool.add_client(id="clienttest", access_token_validity=Duration.minutes(60),
                        auth_flows=cognito.AuthFlow(custom=True, admin_user_password=True, user_srp=True),
                        generate_secret=True,
                        o_auth=cognito.OAuthSettings(scopes=[cognito.OAuthScope.resource_server(user_server, full_scope)],
                                                    flows=cognito.OAuthFlows(client_credentials=True
                                                                            )))

        api_integration = ApiIntegration(id="testlambda", existing_lambda_obj=lambda_basic)

        api_definition_asset = s3_assets.Asset(self, "ApiDefinitionAsset", path="./openapi/openapi.yaml")


        rest_api_base_props = apigateway.RestApiBaseProps(deploy_options=apigateway.StageOptions(stage_name="dev"),
                                                          rest_api_name="test openapi dev REST API",
                                                          description="just a test")

        api_gateway_to_lambda = OpenApiGatewayToLambda(self, id="testopenapi",
                                                        api_integrations=[api_integration],
                                                    api_definition_asset=api_definition_asset, 
                                                    api_gateway_props=rest_api_base_props,
                                                        )

Here are the list of aws cdk and solutions libraries I'm using:

aws-cdk-lib==2.104.0
aws-cdk.asset-awscli-v1==2.2.201
aws-cdk.asset-kubectl-v20==2.1.2
aws-cdk.asset-node-proxy-agent-v6==2.0.1
aws-cdk.aws-lambda-python-alpha==2.104.0a0
aws-solutions-constructs.aws-openapigateway-lambda==2.45.0
aws-solutions-constructs.core==2.45.0
aws-solutions-constructs.resources==2.45.0

Also, here is the snippet where the logical id shows as coogneeto in the template.json file.

  "coogneeto": {
   "Type": "AWS::Cognito::UserPool",
   "Properties": {...
    }

tldr; How can I get the arn to fill in the openapi.yaml template?

[drissamri]

I've attached a working example in TypeScript for you. It boils down to:

• Set (and override) the logical ID so it doesn't get suffixed by CDK which it does for all resources
• Use Fn::Sub in OpenAPI and reference the logical ID

This works fine, until you try to reference resource in a different CDK stack, but if Cognito and APIGW are in the same CDK stack this works.
single-stack (2).zip

[bmckinle]

We are trying this now, but thought we had tried this once before. We'll get another shot as maybe we missed something.