apigateway: Missing authorization on imported/referenced API Gateway

[ryancormack]

Describe the bug

When 'importing' or referencing an existing Rest API Gateway using the fromRestApiAttributes method, the referenced Gateway is missing at least the default method authorization options.

When you define default method options

    const rootGateway = new api.RestApi(this, "api", {
      restApiName: "api",
      defaultMethodOptions: {
        authorizationType: api.AuthorizationType.COGNITO,
        authorizer: cognitoAuthorizer,
      },
    });

each route and method under that gateway, when in the same CF Stack will inherit these properties. In this example, if I wanted a public method, I would now have to explicitly make the route and method public.

But when referencing this Gateway via fromRestApiAttributes in a different CF Stack, and new route and method I make are public by default.

    const apiRoot = api.RestApi.fromRestApiAttributes(this, "RootGateway",
        {
          restApiId: ssm.StringParameter.valueForStringParameter(this, apiIdSsmKey),
          rootResourceId: ssm.StringParameter.valueForStringParameter(this, apiRootIdSsmKey),
        }
      );

Any method added to apiRoot is now public. This is different behaviour from adding a method/root in rootGateway.

In scenarios where people are building directly against an IRestApi it's not always obvious if it was referenced/imported or created as part of the same stack. This then requires people to specifically add an authorizer at each child set of routes. This is likely (possibly?) undesired behaviour when a Gateway team may own the central gateway and authorization logic and allow other teams to add their own routes to it.

If a team broken an existing API out into multiple stacks for any number of reasons, referencing the parent gateway would now cause a change to the authorization/authentication logic which wouldn't be desirable.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

The IRestApi returned from RestApi.fromRestApiAttributes across stacks has the same behaviour and properties as the IRestApi created in the same stack. All default options should be inherited by the new child providing consistent behavior regardless of where the gateway was first defined.

Current Behavior

The IRestApi returned from RestApi.fromRestApiAttributes is missing at least the authentication properties from the parent gateway. This results API Methods added to an IRestApi having different behaviour depending on where the IRestApi comes from

Reproduction Steps

Repo with repro CF Stacks https://github.com/ryancormack/cdk-api-gw-auth-bug

Current behaviour:

Method on root stack:

Method on 'child' stack

Both of these routes get created with the same code

private const IRestApi api;

this.api.addResource("should-be-private") //could be any route
      .addMethod(
        "ANY",
        new api.MockIntegration({
          integrationResponses: [{ statusCode: "200" }],
          passthroughBehavior: api.PassthroughBehavior.NEVER,
          requestTemplates: { "application/json": '{ "statusCode": 200 }' },
        }),
        { methodResponses: [{ statusCode: "200" }] }
      );

Possible Solution

I think the issue may originate from https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-apigateway/lib/restapi.ts#L798

  /**
   * Import an existing RestApi that can be configured with additional Methods and Resources.
   */
  public static fromRestApiAttributes(scope: Construct, id: string, attrs: RestApiAttributes): IRestApi {
    class Import extends RestApiBase {
      public readonly restApiId = attrs.restApiId;
      public readonly restApiName = attrs.restApiName ?? id;
      public readonly restApiRootResourceId = attrs.rootResourceId;
      public readonly root: IResource = new RootResource(this, {}, this.restApiRootResourceId);
    }

    return new Import(scope, id);
  }

The second value passed to the RootResource is the ResourceOptions which then get used to populate things like the MethodOptions

//rest
  constructor(api: RestApiBase, props: ResourceOptions, resourceId: string) {
    super(api, 'Default');

    this.parentResource = undefined;
    this.defaultIntegration = props.defaultIntegration;
    this.defaultMethodOptions = props.defaultMethodOptions;
    this.defaultCorsPreflightOptions = props.defaultCorsPreflightOptions;
    this.api = api;
    this.resourceId = resourceId;
    this.path = '/';

//rest

As a solution, fromRestApiAttributes could be extended to be able to pass these props through, or take a value to "inherit default options" from a parent gateway

Additional Information/Context

No response

CDK CLI Version

2.173.2

Framework Version

No response

Node.js Version

22

OS

OSx latest

Language

TypeScript

Language Version

No response

Other information

No response

[ashishdhingra]

Needs reproduction.

[ryancormack]

Hey @ashishdhingra I added a link to a repo with reproduction in the report(but seems like it gets pretty burrowed), but here it is, https://github.com/ryancormack/cdk-api-gw-auth-bug

[ashishdhingra]

Hey @ashishdhingra I added a link to a repo with reproduction in the report(but seems like it gets pretty burrowed), but here it is, https://github.com/ryancormack/cdk-api-gw-auth-bug

@ryancormack Apologies for the late response. Thanks for the reproduction code. The issue is reproducible using code provided by you. The probable reason is that CDK's fromXXXAttributes() is usually designed to reference existing CloudFormation resources. In most cases, it doesn't allow additional behavior to be invoked properly (refer existing issue #30385).

Adding repro code below for easy reference for the team.

---

lib/restapi-rootgateway-stack.ts

import * as cdk from "aws-cdk-lib";
import * as cognito from "aws-cdk-lib/aws-cognito";
import * as api from "aws-cdk-lib/aws-apigateway";
import * as ssm from "aws-cdk-lib/aws-ssm";

export class RestapiRootGatewayStack extends cdk.Stack {
  private readonly apiRoot: api.IRestApi;
  
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const apiIdSsmKey = '/api-gw-bug/api-id'
    const apiRootIdSsmKey = '/api-gw-bug/api-root-id';

    const userPool = new cognito.UserPool(this, "user-pool", {});
    const cognitoAuthorizer = new api.CognitoUserPoolsAuthorizer(
      this,
      "cognito-authorizer",
      {
        cognitoUserPools: [userPool],
      }
    );

    this.apiRoot = new api.RestApi(this, "api", {
      restApiName: "api",
      defaultMethodOptions: {
        authorizationType: api.AuthorizationType.COGNITO,
        authorizer: cognitoAuthorizer,
      },
    });

    //This should be private/cognito auth
    //It uses the default Cognito Auth from the root Gateway
    const privateRoute = this.apiRoot.root
    .addResource("private")
    .addMethod(
      "ANY",
      new api.MockIntegration({
        integrationResponses: [{ statusCode: "200" }],
        passthroughBehavior: api.PassthroughBehavior.NEVER,
        requestTemplates: {
          "application/json": '{ "statusCode": 200 }',
        },
      }),
      {
        methodResponses: [{ statusCode: "200" }],
      }
    );

    //This should be public
    //I'm explicity 'overriding' the default Cognito Auth
    const publicRoute = this.apiRoot.root
      .addResource("public", {
        defaultMethodOptions: {
          authorizationType: api.AuthorizationType.NONE, //No auth on this path
          //This is also required with the above. It feels like it shouldn't be if Auth is set to None?
          authorizer: undefined,
        },
      })
      .addMethod(
        "ANY",
        new api.MockIntegration({
          integrationResponses: [{ statusCode: "200" }],
          passthroughBehavior: api.PassthroughBehavior.NEVER,
          requestTemplates: {
            "application/json": '{ "statusCode": 200 }',
          },
        }),
        {
          methodResponses: [{ statusCode: "200" }],
        }
      );

    const apiId = new ssm.StringParameter(this, "apiId", {
      parameterName: apiIdSsmKey,
      stringValue: this.apiRoot.restApiId,
    });

    const apiRootId = new ssm.StringParameter(this, "apiRootId", {
      parameterName: apiRootIdSsmKey,
      stringValue: this.apiRoot.restApiRootResourceId,
    });
  }
}

lib/restapi-childgateway-stack.ts

import * as cdk from "aws-cdk-lib";
import * as cognito from "aws-cdk-lib/aws-cognito";
import * as api from "aws-cdk-lib/aws-apigateway";
import * as ssm from "aws-cdk-lib/aws-ssm";

export class RestapiChildGatewayStack extends cdk.Stack {
  private readonly apiRoot: api.IRestApi;

  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const apiIdSsmKey = '/api-gw-bug/api-id'
    const apiRootIdSsmKey = '/api-gw-bug/api-root-id';

    this.apiRoot = api.RestApi.fromRestApiAttributes(
      this,
      "RootGateway",
      {
        restApiId: ssm.StringParameter.valueForStringParameter(
          this,
          apiIdSsmKey
        ),
        rootResourceId: ssm.StringParameter.valueForStringParameter(
          this,
          apiRootIdSsmKey
        ),
      }
    );

    const childGateway = this.apiRoot.root.addResource("child");

    const privateChild = childGateway
      .addResource("should-be-private")
      .addMethod(
        "ANY",
        new api.MockIntegration({
          integrationResponses: [{ statusCode: "200" }],
          passthroughBehavior: api.PassthroughBehavior.NEVER,
          requestTemplates: { "application/json": '{ "statusCode": 200 }' },
        }),
        { methodResponses: [{ statusCode: "200" }] }
      );

    const publicChild = childGateway
      .addResource("should-be-public", {
        defaultMethodOptions: {
          authorizationType: api.AuthorizationType.NONE,
          authorizer: undefined,
        },
      })
      .addMethod(
        "ANY",
        new api.MockIntegration({
          integrationResponses: [{ statusCode: "200" }],
          passthroughBehavior: api.PassthroughBehavior.NEVER,
          requestTemplates: { "application/json": '{ "statusCode": 200 }' },
        }),
        { methodResponses: [{ statusCode: "200" }] }
      );
  }
}

bin/cdktest.ts*

#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { RestapiRootGatewayStack } from '../lib/restapi-rootgateway-stack';
import { RestapiChildGatewayStack } from '../lib/restapi-childgateway-stack';

const app = new cdk.App();

const restapiRootGatewayStack = new RestapiRootGatewayStack(app, 'RestapiRootGatewayStack', {
});
const restapiChildGatewayStack = new RestapiChildGatewayStack(app, 'RestapiChildGatewayStack', {
})
restapiChildGatewayStack.addDependency(restapiRootGatewayStack);

const assembly = app.synth();

In lib/restapi-childgateway-stack.ts, changing to const childGateway = this.apiRoot.root; also doesn't add the default authorizer options.