Skip to content

Commit 3d2ec3d

Browse files
GavinZZGavinZZ
authored
Merge pull request #3359 from aws/release-v1.76.0
Release 1.76.0 (to main)
2 parents c928dc4 + 6f693f6 commit 3d2ec3d

File tree

125 files changed

+5314
-2345
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

125 files changed

+5314
-2345
lines changed

‎integration/combination/test_api_with_authorizer_override_api_auth.py

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
from unittest.case import skipIf
2+
3+
from integration.config.service_names import API_KEY, COGNITO, REST_API
4+
from integration.helpers.base_test import BaseTest
5+
from integration.helpers.deployer.utils.retry import retry
6+
from integration.helpers.exception import StatusCodeError
7+
from integration.helpers.resource import current_region_does_not_support
8+
9+
10+
@skipIf(
11+
current_region_does_not_support([COGNITO, API_KEY, REST_API]), "Cognito is not supported in this testing region"
12+
)
13+
class TestApiWithAuthorizerOverrideApiAuth(BaseTest):
14+
def test_authorizer_override_api_auth(self):
15+
self.create_and_verify_stack("combination/api_with_authorizer_override_api_auth")
16+
17+
stack_outputs = self.get_stack_outputs()
18+
19+
base_url = stack_outputs["ApiUrl"]
20+
21+
# Default case with no Auth override
22+
self.verify_authorized_request(base_url + "lambda-request?authorization=allow", 200)
23+
self.verify_authorized_request(base_url + "lambda-request", 401)
24+
25+
# Override Auth to NONE, lambda request should pass without authorization
26+
self.verify_authorized_request(base_url + "lambda-request-override-none", 200)
27+
28+
# Override Auth to CognitoUserPool, lambda request should fail with authorization for lambda request
29+
self.verify_authorized_request(base_url + "lambda-request-override-cognito?authorization=allow", 401)
30+
31+
@retry(StatusCodeError, 10, 0.25)
32+
def verify_authorized_request(
33+
self,
34+
url,
35+
expected_status_code,
36+
header_key=None,
37+
header_value=None,
38+
):
39+
if not header_key or not header_value:
40+
response = self.do_get_request_with_logging(url)
41+
else:
42+
headers = {header_key: header_value}
43+
response = self.do_get_request_with_logging(url, headers)
44+
status = response.status_code
45+
46+
if status != expected_status_code:
47+
raise StatusCodeError(
48+
f"Request to {url} failed with status: {status}, expected status: {expected_status_code}"
49+
)
50+
51+
if not header_key or not header_value:
52+
self.assertEqual(
53+
status, expected_status_code, "Request to " + url + " must return HTTP " + str(expected_status_code)
54+
)
55+
else:
56+
self.assertEqual(
57+
status,
58+
expected_status_code,
59+
"Request to "
60+
+ url
61+
+ " ("
62+
+ header_key
63+
+ ": "
64+
+ header_value
65+
+ ") must return HTTP "
66+
+ str(expected_status_code),
67+
)
68+
69+
70+
def get_authorizer_by_name(authorizers, name):
71+
for authorizer in authorizers:
72+
if authorizer["name"] == name:
73+
return authorizer
74+
return None
75+
76+
77+
def get_resource_by_path(resources, path):
78+
for resource in resources:
79+
if resource["path"] == path:
80+
return resource
81+
return None
82+
83+
84+
def get_method(resources, path, rest_api_id, apigw_client):
85+
resource = get_resource_by_path(resources, path)
86+
return apigw_client.get_method(restApiId=rest_api_id, resourceId=resource["id"], httpMethod="GET")

‎integration/resources/expected/combination/api_with_authorizer_override_api_auth.json

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
[
2+
{
3+
"LogicalResourceId": "MyApi",
4+
"ResourceType": "AWS::ApiGateway::RestApi"
5+
},
6+
{
7+
"LogicalResourceId": "MyApiMyLambdaRequestAuthAuthorizerPermission",
8+
"ResourceType": "AWS::Lambda::Permission"
9+
},
10+
{
11+
"LogicalResourceId": "MyApiProdStage",
12+
"ResourceType": "AWS::ApiGateway::Stage"
13+
},
14+
{
15+
"LogicalResourceId": "MyCognitoUserPool",
16+
"ResourceType": "AWS::Cognito::UserPool"
17+
},
18+
{
19+
"LogicalResourceId": "MyCognitoUserPoolClient",
20+
"ResourceType": "AWS::Cognito::UserPoolClient"
21+
},
22+
{
23+
"LogicalResourceId": "MyApiDeployment",
24+
"ResourceType": "AWS::ApiGateway::Deployment"
25+
},
26+
{
27+
"LogicalResourceId": "MyFunction",
28+
"ResourceType": "AWS::Lambda::Function"
29+
},
30+
{
31+
"LogicalResourceId": "MyFunctionRole",
32+
"ResourceType": "AWS::IAM::Role"
33+
},
34+
{
35+
"LogicalResourceId": "MyFunctionLambdaRequestPermissionProd",
36+
"ResourceType": "AWS::Lambda::Permission"
37+
},
38+
{
39+
"LogicalResourceId": "MyFunctionLambdaRequestOverrideNonePermissionProd",
40+
"ResourceType": "AWS::Lambda::Permission"
41+
},
42+
{
43+
"LogicalResourceId": "MyFunctionLambdaRequestOverrideCognitoPermissionProd",
44+
"ResourceType": "AWS::Lambda::Permission"
45+
},
46+
{
47+
"LogicalResourceId": "MyLambdaAuthFunction",
48+
"ResourceType": "AWS::Lambda::Function"
49+
},
50+
{
51+
"LogicalResourceId": "MyLambdaAuthFunctionRole",
52+
"ResourceType": "AWS::IAM::Role"
53+
}
54+
]

‎integration/resources/templates/combination/api_with_authorizer_apikey.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Resources:
1414
Type: AWS::Serverless::Function
1515
Properties:
1616
Handler: index.handler
17-
Runtime: nodejs16.x
17+
Runtime: nodejs18.x
1818
InlineCode: |
1919
exports.handler = async (event, context, callback) => {
2020
return {
@@ -45,7 +45,7 @@ Resources:
4545
Type: AWS::Serverless::Function
4646
Properties:
4747
Handler: index.handler
48-
Runtime: nodejs16.x
48+
Runtime: nodejs18.x
4949
InlineCode: |
5050
exports.handler = async (event, context, callback) => {
5151
console.log(event);

‎integration/resources/templates/combination/api_with_authorizer_override_api_auth.yaml

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
Resources:
2+
MyApi:
3+
Type: AWS::Serverless::Api
4+
Properties:
5+
StageName: Prod
6+
DefinitionBody:
7+
# Simple AWS Proxy API
8+
swagger: '2.0'
9+
info:
10+
version: '2016-09-23T22:23:23Z'
11+
title: Simple Api
12+
schemes:
13+
- https
14+
paths:
15+
/lambda-request:
16+
get:
17+
x-amazon-apigateway-integration:
18+
type: aws_proxy
19+
uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFunction.Arn}/invocations
20+
httpMethod: POST
21+
passthroughBehavior: when_no_match
22+
/lambda-request-override-none:
23+
get:
24+
x-amazon-apigateway-integration:
25+
type: aws_proxy
26+
uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFunction.Arn}/invocations
27+
httpMethod: POST
28+
passthroughBehavior: when_no_match
29+
/lambda-request-override-cognito:
30+
get:
31+
x-amazon-apigateway-integration:
32+
type: aws_proxy
33+
uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFunction.Arn}/invocations
34+
httpMethod: POST
35+
passthroughBehavior: when_no_match
36+
Auth:
37+
Authorizers:
38+
MyCognitoAuthorizer:
39+
UserPoolArn:
40+
Fn::GetAtt: MyCognitoUserPool.Arn
41+
MyLambdaRequestAuth:
42+
FunctionPayloadType: REQUEST
43+
FunctionArn:
44+
Fn::GetAtt: MyLambdaAuthFunction.Arn
45+
Identity:
46+
QueryStrings:
47+
- authorization
48+
DefaultAuthorizer: MyLambdaRequestAuth
49+
50+
MyFunction:
51+
Type: AWS::Serverless::Function
52+
Properties:
53+
InlineCode: |
54+
exports.handler = async (event, context, callback) => {
55+
return {
56+
statusCode: 200,
57+
body: 'Success'
58+
}
59+
}
60+
Handler: index.handler
61+
Runtime: nodejs16.x
62+
Events:
63+
LambdaRequest:
64+
Type: Api
65+
Properties:
66+
RestApiId:
67+
Ref: MyApi
68+
Method: get
69+
Auth:
70+
Authorizer: MyLambdaRequestAuth
71+
Path: /lambda-request
72+
LambdaRequestOverrideNone:
73+
Type: Api
74+
Properties:
75+
RestApiId:
76+
Ref: MyApi
77+
Method: get
78+
Auth:
79+
Authorizer: NONE
80+
OverrideApiAuth: true
81+
Path: /lambda-request-override-none
82+
LambdaRequestOverrideCognito:
83+
Type: Api
84+
Properties:
85+
RestApiId:
86+
Ref: MyApi
87+
Method: get
88+
Auth:
89+
Authorizer: MyCognitoAuthorizer
90+
OverrideApiAuth: true
91+
Path: /lambda-request-override-cognito
92+
93+
MyLambdaAuthFunction:
94+
Type: AWS::Serverless::Function
95+
Properties:
96+
Handler: index.handler
97+
Runtime: nodejs16.x
98+
InlineCode: |
99+
exports.handler = async (event, context, callback) => {
100+
const auth = event.queryStringParameters.authorization
101+
const policyDocument = {
102+
Version: '2012-10-17',
103+
Statement: [{
104+
Action: 'execute-api:Invoke',
105+
Effect: auth && auth.toLowerCase() === 'allow' ? 'Allow' : 'Deny',
106+
Resource: event.methodArn
107+
}]
108+
}
109+
110+
return {
111+
principalId: 'user',
112+
context: {},
113+
policyDocument
114+
}
115+
}
116+
117+
MyCognitoUserPool:
118+
Type: AWS::Cognito::UserPool
119+
Properties:
120+
UserPoolName: MyCognitoUserPool
121+
122+
MyCognitoUserPoolClient:
123+
Type: AWS::Cognito::UserPoolClient
124+
Properties:
125+
UserPoolId:
126+
Ref: MyCognitoUserPool
127+
ClientName: MyCognitoUserPoolClient
128+
GenerateSecret: false
129+
130+
Outputs:
131+
ApiUrl:
132+
Description: API endpoint URL for Prod environment
133+
Value:
134+
Fn::Sub: https://${MyApi}.execute-api.${AWS::Region}.${AWS::URLSuffix}/Prod/
135+
136+
Parameters:
137+
OverrideApiAuthValue:
138+
Type: String
139+
Default: true
140+
141+
Metadata:
142+
SamTransformTest: true

‎integration/resources/templates/combination/api_with_authorizers_invokefunction_set_none.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ Resources:
3131
InlineCode: |
3232
print("hello")
3333
Handler: index.handler
34-
Runtime: nodejs16.x
34+
Runtime: nodejs18.x
3535
Events:
3636
API3:
3737
Type: Api
@@ -50,7 +50,7 @@ Resources:
5050
InlineCode: |
5151
print("hello")
5252
Handler: index.handler
53-
Runtime: nodejs16.x
53+
Runtime: nodejs18.x
5454
Events:
5555
MyApiWithAwsIamAuth:
5656
Type: Api

‎integration/resources/templates/combination/api_with_authorizers_max.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ Resources:
4343
Type: AWS::Serverless::Function
4444
Properties:
4545
Handler: index.handler
46-
Runtime: nodejs16.x
46+
Runtime: nodejs18.x
4747
InlineCode: |
4848
exports.handler = async (event, context, callback) => {
4949
return {
@@ -101,7 +101,7 @@ Resources:
101101
Type: AWS::Serverless::Function
102102
Properties:
103103
Handler: index.handler
104-
Runtime: nodejs16.x
104+
Runtime: nodejs18.x
105105
InlineCode: |
106106
exports.handler = async (event, context, callback) => {
107107
const token = event.type === 'TOKEN' ? event.authorizationToken : event.queryStringParameters.authorization

‎integration/resources/templates/combination/api_with_authorizers_max_openapi.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ Resources:
4646
Type: AWS::Serverless::Function
4747
Properties:
4848
Handler: index.handler
49-
Runtime: nodejs16.x
49+
Runtime: nodejs18.x
5050
InlineCode: |
5151
exports.handler = async (event, context, callback) => {
5252
return {
@@ -114,7 +114,7 @@ Resources:
114114
Type: AWS::Serverless::Function
115115
Properties:
116116
Handler: index.handler
117-
Runtime: nodejs16.x
117+
Runtime: nodejs18.x
118118
InlineCode: |
119119
exports.handler = async (event, context, callback) => {
120120
const token = event.type === 'TOKEN' ? event.authorizationToken : event.queryStringParameters.authorization

‎integration/resources/templates/combination/api_with_authorizers_min.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Resources:
2323
Type: AWS::Serverless::Function
2424
Properties:
2525
Handler: index.handler
26-
Runtime: nodejs16.x
26+
Runtime: nodejs18.x
2727
InlineCode: |
2828
exports.handler = async (event, context, callback) => {
2929
return {
@@ -80,7 +80,7 @@ Resources:
8080
Type: AWS::Serverless::Function
8181
Properties:
8282
Handler: index.handler
83-
Runtime: nodejs16.x
83+
Runtime: nodejs18.x
8484
InlineCode: |
8585
exports.handler = async (event, context, callback) => {
8686
const token = event.type === 'TOKEN' ? event.authorizationToken : event.queryStringParameters.authorization

‎integration/resources/templates/combination/api_with_binary_media_types_with_definition_body_openapi.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ Resources:
5151
Type: AWS::Serverless::Function
5252
Properties:
5353
Handler: index.handler
54-
Runtime: nodejs16.x
54+
Runtime: nodejs18.x
5555
CodeUri:
5656
Bucket:
5757
Ref: Bucket

‎integration/resources/templates/combination/api_with_cors.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ Resources:
2222
Type: AWS::Serverless::Function
2323
Properties:
2424
Handler: index.handler
25-
Runtime: nodejs16.x
25+
Runtime: nodejs18.x
2626
CodeUri: ${codeuri}
2727
MemorySize: 128
2828

0 commit comments

Comments
 (0)