Fn::If intrinsic function inside Auth property of "AWS::Serverless::Api" #1859

maslakov · 2020-12-11T18:36:00Z

Description:

In the AWS::Serverless::Api resource I want to specify optional authorizer. For this purpose I try to use Conditions and "!If" intrinsic function. SAM doees not consider such a template as a valid one. I tried already all combinations with "!If" and "Fn::If" and indentation - it does not work.

Steps to reproduce the issue:

Create new template with the following content

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Sample SAM Template for test

Parameters:
  ExternalAuthorizerArn:
    Type: String

Conditions:
  ExternalAuthorizer: !Not [!Equals [ !Ref ExternalAuthorizerArn, '' ]]

Resources:

  ApiGatewayApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Test
      Auth:
        ApiKeyRequired: false
        Fn::If:
        - ExternalAuthorizer
        -
          Authorizers:
            ApiKeyAuth:
              FunctionPayloadType: TOKEN
              FunctionArn: !Ref ExternalAuthorizerArn
              Identity:
                Header: x-api-key
                ReauthorizeEvery: 300
        - !Ref "AWS::NoValue"

try to deploy or just validate it:

sam validate

Observed result:

Template provided at '/Users/xxx/tmp/test/template.yaml' was invalid SAM Template.
Error: [InvalidResourceException('ApiGatewayApi', "Invalid value for 'Auth' property")] ('ApiGatewayApi', "Invalid value for 'Auth' property")

Expected result:

Template is considered as valid and can be deployed with optional parameter ExternalAuthorizerArn set to either empty string or to the specific value.

The text was updated successfully, but these errors were encountered:

tjcarrel · 2021-02-18T22:45:07Z

Would love to see this added. Currently trying to configure an optional Authorizer for my prod stack but not my dev and unable to.

ngalchemist · 2021-04-12T22:57:21Z

This also seems to relate to my issue with the Domain property on the AWS::Serverless::Api resource. My template looks like below.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Test template
Parameters:
  AddApiMapping:
    Default: n
    Type: String
    AllowedValues: [y,n]
    Description: 'y/N'
Conditions:
  AddApiMappingCondition:
    !Or [!Equals ['y', !Ref AddApiMapping], !Equals ['Y', !Ref AddApiMapping]]
Resources:
  ApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      Name: TestApi
      ..
      Domain:
        !If
        - AddApiMappingCondition
        - CertificateArn: !Ref CertificateArn
          DomainName: !Ref ApiMappingDomainName
        - !Ref "AWS::NoValue"

Running sam validate yields the following:

Error: [InvalidResourceException('ApiGateway', 'Custom Domains only works if both DomainName and CertificateArn are provided.')] ('ApiGateway', 'Custom Domains only works if both DomainName and CertificateArn are provided.')

piersf · 2021-04-23T17:00:26Z

Any updates on this?

We ran into this issue as well. We're trying to deploy an API Gateway in the Beijing region where Cognito User Pools are not supported, and we're trying to add a condition in the Auth property that when the region is cn-north-1 the DefaultAuthorizer and Authorizers properties is not included:

Conditions: 
  IsStandardPartition: !Equals [ !Ref AWS::Partition, "aws" ]

AccountManagementApi:
  Type: "AWS::Serverless::Api"
  Properties:
    Name: !Sub "${environment}-${ApiName}-${ApiGatewayConvention}"
    StageName: !Ref ApiStageName
    Auth: 
      !If
        - IsStandardPartition
        -
          ApiKeyRequired: true
          DefaultAuthorizer: AccountManagementCognitoAuthorizer
          UsagePlan:
            UsagePlanName: !Sub "${environment}-${ApiName}-${ApiGatewayConvention}-usage-plan"
            CreateUsagePlan: PER_API
            Quota:
              Limit: !Ref ApiGatewayRequestQuota
              Period: DAY
            Throttle:
              BurstLimit: !Ref ApiGatewayRequestBurstLimit
              RateLimit: !Ref ApiGatewayRequestRateLimit
          Authorizers:
            AccountManagementCognitoAuthorizer:
              UserPoolArn:
                Fn::ImportValue: !Sub "stack-${environment}-AccountManagementCognitoUserPoolArn"
              AuthorizationScopes:
                - !Sub "${environment}-account-management-api-cognito-user-pool-resource-server/aws.account.management.create_account"
          ResourcePolicy:
            IpRangeWhitelist: !Ref AllowedIpsWhitelist
        -
          ApiKeyRequired: true
          UsagePlan:
            UsagePlanName: !Sub "${environment}-${ApiName}-${ApiGatewayConvention}-usage-plan"
            CreateUsagePlan: PER_API
            Quota:
              Limit: !Ref ApiGatewayRequestQuota
              Period: DAY
            Throttle:
              BurstLimit: !Ref ApiGatewayRequestBurstLimit
              RateLimit: !Ref ApiGatewayRequestRateLimit
          ResourcePolicy:
            IpRangeWhitelist: !Ref AllowedIpsWhitelist

But the above fails with the following error:

Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state Status: FAILED. Reason: Transform AWS::Serverless-2016-10-31 failed with: Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [AccountManagementApi] is invalid. Invalid value for 'Auth' property

The related line in the code where it fails is

serverless-application-model/samtranslator/model/api/api_generator.py

Line 560 in 32211f2

    
           raise InvalidResourceException(self.logical_id, "Invalid value for 'Auth' property")

dkwgit · 2021-05-09T17:57:43Z

Having same issue. Cannot make a resource policy conditional.

singhsoldier13 · 2021-07-08T18:41:42Z

Having the same issue. Is there a workaround?

matthewhembree · 2022-01-05T23:33:29Z

Off topic:
@ngalchemist @m-chandler This workaround will solve your issue with conditional domain:

Parameters:
  CustomDomainName:
    Type: String
    Description: Domain name for api (e.g. my_service.<environment>.example.com)
    Default: 'false'
  ZoneId:
    Type: AWS::SSM::Parameter::Value<String>
    Description: Route53 zone ID from SSM Parameter Store.
    Default: external-route53-zone-id

Conditions:
  ApiCustomDomain: !Not
    - !Equals
      - 'false'
      - !Ref CustomDomainName

Resources:
  ApiSSLCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      CertificateTransparencyLoggingPreference: DISABLED
      DomainName: !Ref CustomDomainName
      ValidationMethod: DNS
      DomainValidationOptions:
        DomainName: !Ref CustomDomainName
        HostedZoneId: !Ref ZoneId
    Condition: ApiCustomDomain
  ApiCustomDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      DomainName: !Ref CustomDomainName
      EndpointConfiguration:
        Types:
          - REGIONAL
      RegionalCertificateArn: !Ref ApiSSLCertificate
      SecurityPolicy: TLS_1_2
    Condition: ApiCustomDomain
  ApiCustomDomainRecord:
    Type: AWS::Route53::RecordSet
    Properties:
      HostedZoneId: !Ref ZoneId
      Name: !Ref CustomDomainName
      ResourceRecords:
        - !GetAtt ApiCustomDomain.RegionalDomainName
      TTL: 900
      Type: CNAME
    Condition: ApiCustomDomain
  ApiCustomDomainMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      DomainName: !Ref ApiCustomDomain
      RestApiId: !Ref Api
      Stage: !Ref Api.Stage  # This is a resource generated when the stack is deployed.
    Condition: ApiCustomDomain
  Api:
    Type: AWS::Serverless::Api
    Properties:
      ... # Don't specify `Domain:`. It's handled with `ApiCustomDomainMapping`.

ghost · 2022-04-26T03:21:27Z

When will this issue be addressed?
I cannot specify different Auth.ResourcePolicy for API gateway depending on different environments.
As a workaround, I had to deploy different API gateway for different environments using Condition.

Then, due to the issue that AWS::Serverless::Function Property "RestApiId" does not support If either.
I end up with 2 Lambda & 2 API gateway with different configurations in the CFN for dev and non-dev environments.
Which is not very nice at all. Can this be addressed sooner, please?

hoffa · 2022-10-17T21:10:04Z

You might be able to get this to work by adding AWS::LanguageExtensions to Transform as such:

Transform:
  - AWS::LanguageExtensions
  - AWS::Serverless-2016-10-31

AWS::LanguageExtensions resolves intrinsic functions if the value is known when Transforms are run.

See #2533 for more information.

hoffa · 2022-11-03T23:12:41Z

Closing in favor of #2533.

maciejmesjasz · 2022-12-12T11:26:56Z

@hoffa Even with AWS::LanguageExtensions, it's not deployable because both SAM CLI and AWS detects that if is not supported

hoffa · 2022-12-12T12:46:30Z

@hoffa Even with AWS::LanguageExtensions, it's not deployable because both SAM CLI and AWS detects that if is not supported

Do you have a reproducible template? I did something similar in #214 (comment).

maciejmesjasz · 2022-12-12T12:58:39Z

I've tried implementing If to conditionally add (or not to add) Auth section for AWS::Serverless:API but even after adding this extra macro (obviously, before the Serverless) - I got an error that If is not a supported property for the resource.

I'm currently writing a custom macro that is removing that Auth section from the template if it detects a certain environment, but native intrinsic functions support would be great to see in the near future :)

hoffa · 2022-12-12T13:14:55Z

I've tried implementing If to conditionally add (or not to add) Auth section for AWS::Serverless:API but even after adding this extra macro (obviously, before the Serverless) - I got an error that If is not a supported property for the resource.

I'm currently writing a custom macro that is removing that Auth section from the template if it detects a certain environment, but native intrinsic functions support would be great to see in the near future :)

I tried by creating the following template template.yaml:

Transform:
  - AWS::LanguageExtensions
  - AWS::Serverless-2016-10-31

Parameters:
  WithAuth:
    Type: String

Conditions:
  WithAuthCondition: !Equals [!Ref WithAuth, "yes"]

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.8
      Handler: foo
      InlineCode: bar
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Method: get
            Path: /
            RestApiId: !Ref MyApi

  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: prod
      Auth:
        Authorizers:
          Fn::If:
            - WithAuthCondition
            - LambdaRequestAuthorizer:
                FunctionArn: !GetAtt MyFunction.Arn
            - !Ref AWS::NoValue

Then deploying without authorizer:

sam deploy --region us-west-2 --resolve-s3 --capabilities CAPABILITY_IAM --stack-name test-1859 --template template.yaml --parameter-overrides WithAuth=no

And with authorizer:

sam deploy --region us-west-2 --resolve-s3 --capabilities CAPABILITY_IAM --stack-name test-1859 --template template.yaml --parameter-overrides WithAuth=yes

And it seems to work as expected.

maciejmesjasz · 2022-12-12T13:41:08Z

Wow, Thank you @hoffa it's working as expected!!!
Turned out I've been using "!If" rather than "Fn::If:"

mndeveci added type/feature stage/pm-review Waiting for review by our Product Manager, please don't work on this yet labels Dec 21, 2020

wchengru added the area/intrinsics Ref, If, Sub, GetAtt, ... label Mar 10, 2021

m-chandler mentioned this issue Sep 8, 2021

Unable to create AWS::Serverless::Api with Domain configuration localstack/localstack#4559

Closed

1 task

aws-sam-cli-bot added the maintainer/need-response label Nov 23, 2021

hoffa mentioned this issue Oct 11, 2022

Unsupported intrinsic functions #2533

Open

hoffa added the intrinsics/resolvable-predeployment label Oct 17, 2022

aws-sam-cli-bot removed the maintainer/need-response label Oct 18, 2022

hoffa closed this as completed Nov 3, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fn::If intrinsic function inside Auth property of "AWS::Serverless::Api" #1859

Fn::If intrinsic function inside Auth property of "AWS::Serverless::Api" #1859

maslakov commented Dec 11, 2020 •

edited

Loading

tjcarrel commented Feb 18, 2021 •

edited

Loading

ngalchemist commented Apr 12, 2021

piersf commented Apr 23, 2021 •

edited

Loading

dkwgit commented May 9, 2021

singhsoldier13 commented Jul 8, 2021

matthewhembree commented Jan 5, 2022

ghost commented Apr 26, 2022 •

edited by ghost

Loading

hoffa commented Oct 17, 2022

hoffa commented Nov 3, 2022

maciejmesjasz commented Dec 12, 2022 •

edited

Loading

hoffa commented Dec 12, 2022

maciejmesjasz commented Dec 12, 2022

hoffa commented Dec 12, 2022

maciejmesjasz commented Dec 12, 2022

Fn::If intrinsic function inside Auth property of "AWS::Serverless::Api" #1859

Fn::If intrinsic function inside Auth property of "AWS::Serverless::Api" #1859

Comments

maslakov commented Dec 11, 2020 • edited Loading

tjcarrel commented Feb 18, 2021 • edited Loading

ngalchemist commented Apr 12, 2021

piersf commented Apr 23, 2021 • edited Loading

dkwgit commented May 9, 2021

singhsoldier13 commented Jul 8, 2021

matthewhembree commented Jan 5, 2022

ghost commented Apr 26, 2022 • edited by ghost Loading

hoffa commented Oct 17, 2022

hoffa commented Nov 3, 2022

maciejmesjasz commented Dec 12, 2022 • edited Loading

hoffa commented Dec 12, 2022

maciejmesjasz commented Dec 12, 2022

hoffa commented Dec 12, 2022

maciejmesjasz commented Dec 12, 2022

maslakov commented Dec 11, 2020 •

edited

Loading

tjcarrel commented Feb 18, 2021 •

edited

Loading

piersf commented Apr 23, 2021 •

edited

Loading

ghost commented Apr 26, 2022 •

edited by ghost

Loading

maciejmesjasz commented Dec 12, 2022 •

edited

Loading