@aws-cdk/aws-apigatewayv2:setting one authorizer for many routes is patchy

[mat01]

Describe the bug

I have a HTTP api with two groupings of routes.

For one grouping, I'm using a Cognito authorizer.

The authorizer is defined like this :

const Auth1 = new apiGatewayAuthorizers.HttpUserPoolAuthorizer('auth1', userPool, {userPoolClients: [userPoolClient],identitySource: ['$request.header.Authorization']});

and I apply it to a route like this :

httpApi.addRoutes({ path: '/route',methods: [ apigwv2.HttpMethod.POST ], integration: myIntegration, authorizer:Auth1});

With this 'first group' of routes, I initially had problems applying this authorizer to more than one route. Bizarrely, changing the const name from 'CognitoAuthorizer' to 'Auth1' seemed to allow me to do this?!

Now I am on to my second group of routes (on the same API), this time using a standard api-key based authorizer (Auth2).

This is defined as

const Auth2 = new apiGatewayAuthorizers.HttpLambdaAuthorizer('auth2b',backLambdas.backendAuthorizer,{identitySource: ['$request.header.Authorization'],resultsCacheTtl:cdk.Duration.minutes(1)});

Again, I have the same error message that I originally got with Auth1.

Authorizer name must be unique. Authorizer auth2b already exists in this RestApi.

Expected Behavior

I expect to be allowed to use one authorizer for multiple routes

Current Behavior

I am prevented from using one authorizer for multiple routes with the error message

Authorizer name must be unique. Authorizer auth2b already exists in this RestApi.

Reproduction Steps

cdk deploy

Possible Solution

The problem seems to be centred around names and ids of resources within the CDK.

Additional Information/Context

No response

CDK CLI Version

2.21.1

Framework Version

No response

Node.js Version

v16.14.2

OS

windows powershell

Language

Typescript

Language Version

No response

Other information

No response

[mat01]

Update - I have managed to set my 2nd authorizer on 'group2' of my routes by specifying it as the API default authorizer.

However, this didn't work the first time I tried it, again I got the 'non unique authorizer' name error.

When I changed both the const name and the logical id of the second authorizer that I was trying to use for the API default, it did work when deployed, and I can see both authorizers shown on the http api auth status screen.

Is the cdk not liking existing authorizer names, and failing to differentiate between old and new?

[peterwoodworth]

Hey @mat01,

Each time your HttpLambdaAuthorizer is bound to a route, it creates a new authorizer with the name seen here

aws-cdk/packages/@aws-cdk/aws-apigatewayv2-authorizers/lib/http/lambda.ts

Line 103 in ab28878

authorizerName: this.props.authorizerName ?? this.id,

HttpApi.addRoutes() doesn't pass in the authorizerName prop when it calls the bind() method, so the authorizerName for your new authorizer created with these routes will always be what you passed in as the id for your authorizers.

This could potentially be fixed by having the addRoutes() method have the option to name the authorizer and then pass this when it calls bind()

aws-cdk/packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts

Lines 196 to 199 in ab28878

	this.authBindResult = props.authorizer?.bind({
	route: this,
	scope: this.httpApi instanceof Construct ? this.httpApi : this, // scope under the API if it's not imported
	});