feat(rest-api): SecurityPolicy & EndpointAccessMode support

[afa4]

Summary

• Add support for securityPolicy property under provider.apiGateway to configure TLS version on REST APIs
• Add support for endpointAccessMode property under provider.apiGateway to control API endpoint access mode (STRICT or BASIC)
• Add documentation for both new properties in docs/events/apigateway.md

Fixes #133

Example of usage:

provider:
  name: aws
  apiGateway:
    securityPolicy: SecurityPolicy_TLS13_2025_EDGE  # Recommended: Use TLS 1.2 or higher
    endpointAccessMode: STRICT

important notice:

both securityPolicy and endpointAccessMode configs are available only for AWS REST API Gateways, which are created when httpevents are used:

functions:
  testFunctionAwsRest:
    handler: index.handler
    events:
      - http:
          path: /test
          method: get

These properties have no effect if httpApi events are being used since this creates an AWS HTTP API (v2) in the CloudFormation stack:

# securityPolicy and endpointAccessMode configs wont have any effect because of httpApi event config
functions:
  testFunctionAwsHttp:
    handler: index.handler
    events:
      - httpApi:
          # ...

[mnapoli]

Could you cover this with tests?

[afa4]

Could you cover this with tests?

sure, wip

[afa4]

I had to fix some lint issues

[mnapoli]

This needs docs too, sorry I didn't spot that before. Have a look at other merged PRs to get an idea on what's needed to be merged.

[afa4]

This needs docs too, sorry I didn't spot that before. Have a look at other merged PRs to get an idea on what's needed to be merged.

No problem, I'll check everything to ensure the best release possible.

[afa4]

@mnapoli I think something is wrong with "Validate Windows" check. It's being running for 5 hours :s

[Copilot]

Pull request overview

Adds new AWS REST API Gateway configuration options under provider.apiGateway to control TLS security policy and endpoint access mode, wiring them through CloudFormation compilation and documenting their usage.

Changes:

• Extend REST API compilation to include SecurityPolicy and EndpointAccessMode on AWS::ApiGateway::RestApi.
• Add provider schema validation for apiGateway.securityPolicy and apiGateway.endpointAccessMode.
• Add unit tests and documentation covering the new options.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
lib/plugins/aws/package/compile/events/api-gateway/lib/rest-api.js	Passes through securityPolicy/endpointAccessMode into the compiled REST API CloudFormation properties.
lib/plugins/aws/provider.js	Adds config schema entries for provider.apiGateway.securityPolicy and provider.apiGateway.endpointAccessMode.
test/unit/lib/plugins/aws/package/compile/events/api-gateway/lib/rest-api.test.js	Adds/updates unit assertions to cover the new compiled properties.
docs/events/apigateway.md	Documents securityPolicy and endpointAccessMode usage for REST APIs.
lib/plugins/aws/custom-resources/resources/api-gateway-cloud-watch-role/handler.js	Minor formatting change in error handling condition.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

endpointAccessMode is allowed to be an empty string by the provider schema/docs, but this truthy check skips the assignment when users set it to ''. If the intention is to let users explicitly pass an empty value through to CloudFormation (e.g. for legacy SecurityPolicy behavior), change the condition to check for null/undefined (or property presence) instead of truthiness, and only uppercase when the value is non-empty.

Suggested change

	if (apiGateway.endpointAccessMode) {
	EndpointAccessMode = apiGateway.endpointAccessMode.toUpperCase();
	if (apiGateway.endpointAccessMode != null) {
	EndpointAccessMode =
	apiGateway.endpointAccessMode === ''
	? apiGateway.endpointAccessMode
	: apiGateway.endpointAccessMode.toUpperCase();

[Copilot]

Schema allows endpointAccessMode to be '', but compileRestApi currently ignores empty-string values. Either drop '' from the schema if it’s not meant to be user-configurable, or adjust the compiler to preserve an explicitly configured empty value so config validation and generated CloudFormation stay consistent.

Suggested change

	anyOf: ['strict', 'basic', ''].map(caseInsensitive),
	anyOf: ['strict', 'basic'].map(caseInsensitive),

[Copilot]

Missing ending punctuation and an article: this sentence reads unpolished in the docs. Consider changing it to “A specific explanation of security policy types and structure can be found here: …” (and end with a period).

Suggested change

	Specific explanation about Security Policy types and structure can be found [here](https://aws.amazon.com/blogs/compute/enhancing-api-security-with-amazon-api-gateway-tls-security-policies/)
	A specific explanation of security policy types and structure can be found [here](https://aws.amazon.com/blogs/compute/enhancing-api-security-with-amazon-api-gateway-tls-security-policies/).

[Copilot]

Grammar/parentheses issue: the last clause ends with an extra ) and “access Mode” should be “access mode”. Please rephrase the sentence and end it with proper punctuation (and consider formatting the note as a separate sentence).

Suggested change

You can control how clients access your API Gateway endpoint by setting the `endpointAccessMode` property under `apiGateway` in the `provider` block. Valid values are `STRICT` and `BASIC`. This maps directly to the [EndpointAccessMode](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-apigateway-restapi.html#cfn-apigateway-restapi-endpointaccessmode) property of the `AWS::ApiGateway::RestApi` CloudFormation resource. According to AWS documentation, if a security policy is configured with a legacy template (that doesn't have the `SecurityPolicy_` prefix) access Mode should be empty)

You can control how clients access your API Gateway endpoint by setting the `endpointAccessMode` property under `apiGateway` in the `provider` block. Valid values are `STRICT` and `BASIC`. This maps directly to the [EndpointAccessMode](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-apigateway-restapi.html#cfn-apigateway-restapi-endpointaccessmode) property of the `AWS::ApiGateway::RestApi` CloudFormation resource. According to AWS documentation, if a security policy is configured with a legacy template (that does not have the `SecurityPolicy_` prefix), access mode should be empty.

[GrahamCampbell]

Thanks for getting started here. I've finished off the PR at #167.