Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(apigateway): lambda authorizer does not enforce default cache TTL #27873

Merged
merged 6 commits into from
Nov 20, 2023
Merged

fix(apigateway): lambda authorizer does not enforce default cache TTL #27873

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e872779
fix(apigateway): lambda authorizer does not enforce default cache TTL
lpizzinidev Nov 7, 2023
2b5c50a
updated integration test
lpizzinidev Nov 7, 2023
2594cd4
Merge branch 'main' into gh-27826
lpizzinidev Nov 7, 2023
bdc9a32
updated integration test
lpizzinidev Nov 7, 2023
2795712
Merge branch 'main' into gh-27826
vinayak-kukreja Nov 20, 2023
cc777a1
Merge branch 'main' into gh-27826
sumupitchayan Nov 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...authorizers/integ.request-authorizer.lit.js.snapshot/RequestAuthorizerInteg.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -306,6 +306,7 @@
"MyAuthorizer6575980E": {
"Type": "AWS::ApiGateway::Authorizer",
"Properties": {
"AuthorizerResultTtlInSeconds": 300,
"AuthorizerUri": {
"Fn::Join": [
"",
Expand Down Expand Up @@ -366,6 +367,7 @@
"MySecondAuthorizer25A69B96": {
"Type": "AWS::ApiGateway::Authorizer",
"Properties": {
"AuthorizerResultTtlInSeconds": 300,
"AuthorizerUri": {
"Fn::Join": [
"",
Expand Down
1 change: 1 addition & 0 deletions ...ers/integ.token-authorizer-iam-role.js.snapshot/TokenAuthorizerIAMRoleInteg.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@
"Arn"
]
},
"AuthorizerResultTtlInSeconds": 300,
"AuthorizerUri": {
"Fn::Join": [
"",
Expand Down
1 change: 1 addition & 0 deletions ...ay/test/authorizers/integ.token-authorizer.js.snapshot/TokenAuthorizerInteg.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@
"MyAuthorizer6575980E": {
"Type": "AWS::ApiGateway::Authorizer",
"Properties": {
"AuthorizerResultTtlInSeconds": 300,
"AuthorizerUri": {
"Fn::Join": [
"",
Expand Down
6 changes: 3 additions & 3 deletions packages/aws-cdk-lib/aws-apigateway/lib/authorizers/lambda.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ export interface LambdaAuthorizerProps {
* How long APIGateway should cache the results. Max 1 hour.
* Disable caching by setting this to 0.
*
* @default Duration.minutes(5)
* @default - Duration.minutes(5)
*/
readonly resultsCacheTtl?: Duration;

Expand Down Expand Up @@ -215,7 +215,7 @@ export class TokenAuthorizer extends LambdaAuthorizer {
type: 'TOKEN',
authorizerUri: lambdaAuthorizerArn(props.handler),
authorizerCredentials: props.assumeRole?.roleArn,
authorizerResultTtlInSeconds: props.resultsCacheTtl?.toSeconds(),
authorizerResultTtlInSeconds: props.resultsCacheTtl?.toSeconds() ?? Duration.minutes(5).toSeconds(),
identitySource: props.identitySource || 'method.request.header.Authorization',
identityValidationExpression: props.validationRegex,
};
Expand Down Expand Up @@ -284,7 +284,7 @@ export class RequestAuthorizer extends LambdaAuthorizer {
type: 'REQUEST',
authorizerUri: lambdaAuthorizerArn(props.handler),
authorizerCredentials: props.assumeRole?.roleArn,
authorizerResultTtlInSeconds: props.resultsCacheTtl?.toSeconds(),
authorizerResultTtlInSeconds: props.resultsCacheTtl?.toSeconds() ?? Duration.minutes(5).toSeconds(),
identitySource: props.identitySources.map(is => is.toString()).join(','),
};

Expand Down
29 changes: 29 additions & 0 deletions packages/aws-cdk-lib/aws-apigateway/test/authorizers/lambda.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ describe('lambda authorizer', () => {
Type: 'TOKEN',
RestApiId: stack.resolve(restApi.restApiId),
IdentitySource: 'method.request.header.Authorization',
AuthorizerResultTtlInSeconds: 300,
AuthorizerUri: {
'Fn::Join': [
'',
Expand Down Expand Up @@ -102,6 +103,7 @@ describe('lambda authorizer', () => {
Template.fromStack(stack).hasResourceProperties('AWS::ApiGateway::Authorizer', {
Type: 'REQUEST',
RestApiId: stack.resolve(restApi.restApiId),
AuthorizerResultTtlInSeconds: 0,
AuthorizerUri: {
'Fn::Join': [
'',
Expand Down Expand Up @@ -153,6 +155,33 @@ describe('lambda authorizer', () => {

});

test('request authorizer with default cache TTL', () => {
const stack = new Stack();

const func = new lambda.Function(stack, 'myfunction', {
handler: 'handler',
code: lambda.Code.fromInline('foo'),
runtime: lambda.Runtime.NODEJS_LATEST,
});

const auth = new RequestAuthorizer(stack, 'myauthorizer', {
handler: func,
identitySources: [IdentitySource.header('whoami')],
});

const restApi = new RestApi(stack, 'myrestapi');
restApi.root.addMethod('ANY', undefined, {
authorizer: auth,
authorizationType: AuthorizationType.CUSTOM,
});

Template.fromStack(stack).hasResourceProperties('AWS::ApiGateway::Authorizer', {
Type: 'REQUEST',
RestApiId: stack.resolve(restApi.restApiId),
AuthorizerResultTtlInSeconds: 300,
});
});

test('invalid request authorizer config', () => {
const stack = new Stack();

Expand Down
Loading