Skip to content

Commit c491861

Browse files
mergify[bot]njlynch
mergify[bot]
authored and
njlynch
committed
chore: forward merge 'master' into 'v2-main' (#13662)
Automated action from aws/cdk-ops
2 parents cadb8ff + 081b25d commit c491861

File tree

55 files changed

+1351
-563
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

55 files changed

+1351
-563
lines changed

‎package.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@
1818
"fs-extra": "^9.1.0",
1919
"graceful-fs": "^4.2.6",
2020
"jest-junit": "^12.0.0",
21-
"jsii-diff": "^1.24.0",
22-
"jsii-pacmak": "^1.24.0",
23-
"jsii-rosetta": "^1.24.0",
21+
"jsii-diff": "^1.25.0",
22+
"jsii-pacmak": "^1.25.0",
23+
"jsii-rosetta": "^1.25.0",
2424
"lerna": "^3.22.1",
2525
"standard-version": "^9.1.1",
2626
"typescript": "~3.9.9"

‎packages/@aws-cdk/app-delivery/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"@types/nodeunit": "^0.0.31",
6565
"cdk-build-tools": "0.0.0",
6666
"cdk-integ-tools": "0.0.0",
67-
"fast-check": "^2.13.0",
67+
"fast-check": "^2.14.0",
6868
"nodeunit": "^0.11.3",
6969
"pkglint": "0.0.0"
7070
},

‎packages/@aws-cdk/assert/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
"cdk-build-tools": "0.0.0",
2727
"jest": "^26.6.3",
2828
"pkglint": "0.0.0",
29-
"ts-jest": "^26.5.3"
29+
"ts-jest": "^26.5.4"
3030
},
3131
"dependencies": {
3232
"@aws-cdk/cloud-assembly-schema": "0.0.0",

‎packages/@aws-cdk/assets/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@
7070
"devDependencies": {
7171
"@aws-cdk/assert": "0.0.0",
7272
"@types/nodeunit": "^0.0.31",
73-
"@types/sinon": "^9.0.10",
73+
"@types/sinon": "^9.0.11",
7474
"aws-cdk": "0.0.0",
7575
"cdk-build-tools": "0.0.0",
7676
"cdk-integ-tools": "0.0.0",

‎packages/@aws-cdk/aws-apigatewayv2-authorizers/README.md‎

Lines changed: 86 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
# AWS APIGatewayv2 Authorizers
2+
23
<!--BEGIN STABILITY BANNER-->
34

45
---
@@ -17,24 +18,105 @@
1718

1819
## Table of Contents
1920

21+
- [Introduction](#introduction)
2022
- [HTTP APIs](#http-apis)
23+
- [Default Authorization](#default-authorization)
24+
- [Route Authorization](#route-authorization)
2125
- [JWT Authorizers](#jwt-authorizers)
2226
- [User Pool Authorizer](#user-pool-authorizer)
2327

24-
## HTTP APIs
28+
## Introduction
2529

2630
API Gateway supports multiple mechanisms for controlling and managing access to your HTTP API. They are mainly
2731
classified into Lambda Authorizers, JWT authorizers and standard AWS IAM roles and policies. More information is
2832
available at [Controlling and managing access to an HTTP
2933
API](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-access-control.html).
3034

35+
## HTTP APIs
36+
37+
Access control for Http Apis is managed by restricting which routes can be invoked via.
38+
39+
Authorizers, and scopes can either be applied to the api, or specifically for each route.
40+
41+
### Default Authorization
42+
43+
When using default authorization, all routes of the api will inherit the configuration.
44+
45+
In the example below, all routes will require the `manage:books` scope present in order to invoke the integration.
46+
47+
```ts
48+
const authorizer = new HttpJwtAuthorizer({
49+
...
50+
});
51+
52+
const api = new HttpApi(stack, 'HttpApi', {
53+
defaultAuthorizer: authorizer,
54+
defaultAuthorizationScopes: ['manage:books'],
55+
});
56+
```
57+
58+
### Route Authorization
59+
60+
Authorization can also configured for each Route. When a route authorization is configured, it takes precedence over default authorization.
61+
62+
The example below showcases default authorization, along with route authorization. It also shows how to remove authorization entirely for a route.
63+
64+
- `GET /books` and `GET /books/{id}` use the default authorizer settings on the api
65+
- `POST /books` will require the [write:books] scope
66+
- `POST /login` removes the default authorizer (unauthenticated route)
67+
68+
```ts
69+
const authorizer = new HttpJwtAuthorizer({
70+
...
71+
});
72+
73+
const api = new HttpApi(stack, 'HttpApi', {
74+
defaultAuthorizer: authorizer,
75+
defaultAuthorizationScopes: ['read:books'],
76+
});
77+
78+
api.addRoutes({
79+
...
80+
path: '/books',
81+
method: 'get',
82+
});
83+
84+
api.addRoutes({
85+
...
86+
path: '/books/{id}',
87+
method: 'get',
88+
});
89+
90+
api.addRoutes({
91+
...
92+
path: '/books',
93+
method: 'post',
94+
authorizationScopes: ['write:books']
95+
});
96+
97+
api.addRoutes({
98+
...
99+
path: '/login',
100+
method: 'post',
101+
authorizer: new NoneAuthorizer(),
102+
});
103+
```
104+
31105
## JWT Authorizers
32106

33107
JWT authorizers allow the use of JSON Web Tokens (JWTs) as part of [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html) and [OAuth 2.0](https://oauth.net/2/) frameworks to allow and restrict clients from accessing HTTP APIs.
34108

35-
When configured on a route, the API Gateway service validates the JWTs submitted by the client, and allows or denies access based on its content.
109+
When configured, API Gateway validates the JWT submitted by the client, and allows or denies access based on its content.
110+
111+
The location of the token is defined by the `identitySource` which defaults to the http `Authorization` header. However it also
112+
[supports a number of other options](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html#http-api-lambda-authorizer.identity-sources).
113+
It then decodes the JWT and validates the signature and claims, against the options defined in the authorizer and route (scopes).
114+
For more information check the [JWT Authorizer documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-jwt-authorizer.html).
115+
116+
Clients that fail authorization are presented with either 2 responses:
36117

37-
API gateway uses the `identitySource` to determine where to look for the token. By default it checks the http `Authorization` header. However it also [supports a number of other options](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html#http-api-lambda-authorizer.identity-sources). It then decodes the JWT and validates the signature and claims, against the options defined in the authorizer and route (scopes). For more information check the [JWT Authorizer documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-jwt-authorizer.html).
118+
- `401 - Unauthorized` - When the JWT validation fails
119+
- `403 - Forbidden` - When the JWT validation is successful but the required scopes are not met
38120

39121
```ts
40122
const authorizer = new HttpJwtAuthorizer({
@@ -58,7 +140,7 @@ api.addRoutes({
58140
User Pool Authorizer is a type of JWT Authorizer that uses a Cognito user pool and app client to control who can access your Api. After a successful authorization from the app client, the generated access token will be used as the JWT.
59141

60142
Clients accessing an API that uses a user pool authorizer must first sign in to a user pool and obtain an identity or access token.
61-
They must then use this token in the `Authorization` header of the API call. More information is available at [using Amazon Cognito user
143+
They must then use this token in the specified `identitySource` for the API call. More information is available at [using Amazon Cognito user
62144
pools as authorizer](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html).
63145

64146
```ts

‎packages/@aws-cdk/aws-apigatewayv2-authorizers/test/http/integ.user-pool.expected.json‎

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,29 @@
5454
}
5555
}
5656
},
57+
"MyHttpApiGETHttpIntegration6f095b8469365f72e33fa33d9711b140516EBE31": {
58+
"Type": "AWS::ApiGatewayV2::Integration",
59+
"Properties": {
60+
"ApiId": {
61+
"Ref": "MyHttpApi8AEAAC21"
62+
},
63+
"IntegrationType": "AWS_PROXY",
64+
"IntegrationUri": {
65+
"Fn::GetAtt": [
66+
"lambda8B5974B5",
67+
"Arn"
68+
]
69+
},
70+
"PayloadFormatVersion": "2.0"
71+
}
72+
},
5773
"MyHttpApiGETE0EFC6F8": {
5874
"Type": "AWS::ApiGatewayV2::Route",
5975
"Properties": {
6076
"ApiId": {
6177
"Ref": "MyHttpApi8AEAAC21"
6278
},
6379
"RouteKey": "GET /",
64-
"AuthorizationScopes": [],
6580
"AuthorizationType": "JWT",
6681
"AuthorizerId": {
6782
"Ref": "MyHttpApiUserPoolAuthorizer8754262B"
@@ -79,22 +94,6 @@
7994
}
8095
}
8196
},
82-
"MyHttpApiGETHttpIntegration6f095b8469365f72e33fa33d9711b140516EBE31": {
83-
"Type": "AWS::ApiGatewayV2::Integration",
84-
"Properties": {
85-
"ApiId": {
86-
"Ref": "MyHttpApi8AEAAC21"
87-
},
88-
"IntegrationType": "AWS_PROXY",
89-
"IntegrationUri": {
90-
"Fn::GetAtt": [
91-
"lambda8B5974B5",
92-
"Arn"
93-
]
94-
},
95-
"PayloadFormatVersion": "2.0"
96-
}
97-
},
9897
"MyHttpApiUserPoolAuthorizer8754262B": {
9998
"Type": "AWS::ApiGatewayV2::Authorizer",
10099
"Properties": {

‎packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/integ.alb.expected.json‎

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -608,14 +608,31 @@
608608
"ProtocolType": "HTTP"
609609
}
610610
},
611+
"HttpProxyPrivateApiDefaultRouteHttpIntegration1a580b19954e4317026ffbce1f7d5ade7A32685B": {
612+
"Type": "AWS::ApiGatewayV2::Integration",
613+
"Properties": {
614+
"ApiId": {
615+
"Ref": "HttpProxyPrivateApiA55E154D"
616+
},
617+
"IntegrationType": "HTTP_PROXY",
618+
"ConnectionId": {
619+
"Ref": "HttpProxyPrivateApiVpcLink190366CAE"
620+
},
621+
"ConnectionType": "VPC_LINK",
622+
"IntegrationMethod": "ANY",
623+
"IntegrationUri": {
624+
"Ref": "lblistener657ADDEC"
625+
},
626+
"PayloadFormatVersion": "1.0"
627+
}
628+
},
611629
"HttpProxyPrivateApiDefaultRoute1BDCA252": {
612630
"Type": "AWS::ApiGatewayV2::Route",
613631
"Properties": {
614632
"ApiId": {
615633
"Ref": "HttpProxyPrivateApiA55E154D"
616634
},
617635
"RouteKey": "$default",
618-
"AuthorizationScopes": [],
619636
"Target": {
620637
"Fn::Join": [
621638
"",
@@ -647,24 +664,6 @@
647664
"SecurityGroupIds": []
648665
}
649666
},
650-
"HttpProxyPrivateApiDefaultRouteHttpIntegration1a580b19954e4317026ffbce1f7d5ade7A32685B": {
651-
"Type": "AWS::ApiGatewayV2::Integration",
652-
"Properties": {
653-
"ApiId": {
654-
"Ref": "HttpProxyPrivateApiA55E154D"
655-
},
656-
"IntegrationType": "HTTP_PROXY",
657-
"ConnectionId": {
658-
"Ref": "HttpProxyPrivateApiVpcLink190366CAE"
659-
},
660-
"ConnectionType": "VPC_LINK",
661-
"IntegrationMethod": "ANY",
662-
"IntegrationUri": {
663-
"Ref": "lblistener657ADDEC"
664-
},
665-
"PayloadFormatVersion": "1.0"
666-
}
667-
},
668667
"HttpProxyPrivateApiDefaultStage18B3706E": {
669668
"Type": "AWS::ApiGatewayV2::Stage",
670669
"Properties": {

‎packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/integ.http-proxy.expected.json‎

Lines changed: 36 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -94,14 +94,29 @@
9494
}
9595
}
9696
},
97+
"LambdaProxyApiDefaultRouteHttpIntegration70df0ec52c3e3b6bbc96e64ce3a05f24EE575CBA": {
98+
"Type": "AWS::ApiGatewayV2::Integration",
99+
"Properties": {
100+
"ApiId": {
101+
"Ref": "LambdaProxyApi67594471"
102+
},
103+
"IntegrationType": "AWS_PROXY",
104+
"IntegrationUri": {
105+
"Fn::GetAtt": [
106+
"AlwaysSuccess099EAB05",
107+
"Arn"
108+
]
109+
},
110+
"PayloadFormatVersion": "2.0"
111+
}
112+
},
97113
"LambdaProxyApiDefaultRoute1EB30A46": {
98114
"Type": "AWS::ApiGatewayV2::Route",
99115
"Properties": {
100116
"ApiId": {
101117
"Ref": "LambdaProxyApi67594471"
102118
},
103119
"RouteKey": "$default",
104-
"AuthorizationScopes": [],
105120
"Target": {
106121
"Fn::Join": [
107122
"",
@@ -115,22 +130,6 @@
115130
}
116131
}
117132
},
118-
"LambdaProxyApiDefaultRouteHttpIntegration70df0ec52c3e3b6bbc96e64ce3a05f24EE575CBA": {
119-
"Type": "AWS::ApiGatewayV2::Integration",
120-
"Properties": {
121-
"ApiId": {
122-
"Ref": "LambdaProxyApi67594471"
123-
},
124-
"IntegrationType": "AWS_PROXY",
125-
"IntegrationUri": {
126-
"Fn::GetAtt": [
127-
"AlwaysSuccess099EAB05",
128-
"Arn"
129-
]
130-
},
131-
"PayloadFormatVersion": "2.0"
132-
}
133-
},
134133
"LambdaProxyApiDefaultStage07C38681": {
135134
"Type": "AWS::ApiGatewayV2::Stage",
136135
"Properties": {
@@ -148,27 +147,6 @@
148147
"ProtocolType": "HTTP"
149148
}
150149
},
151-
"HttpProxyApiDefaultRoute8AF66B5C": {
152-
"Type": "AWS::ApiGatewayV2::Route",
153-
"Properties": {
154-
"ApiId": {
155-
"Ref": "HttpProxyApiD0217C67"
156-
},
157-
"RouteKey": "$default",
158-
"AuthorizationScopes": [],
159-
"Target": {
160-
"Fn::Join": [
161-
"",
162-
[
163-
"integrations/",
164-
{
165-
"Ref": "HttpProxyApiDefaultRouteHttpIntegration8eeecf9ecdb91f31bebf6bd54fb711a41921AB82"
166-
}
167-
]
168-
]
169-
}
170-
}
171-
},
172150
"HttpProxyApiDefaultRouteHttpIntegration8eeecf9ecdb91f31bebf6bd54fb711a41921AB82": {
173151
"Type": "AWS::ApiGatewayV2::Integration",
174152
"Properties": {
@@ -200,6 +178,26 @@
200178
"PayloadFormatVersion": "1.0"
201179
}
202180
},
181+
"HttpProxyApiDefaultRoute8AF66B5C": {
182+
"Type": "AWS::ApiGatewayV2::Route",
183+
"Properties": {
184+
"ApiId": {
185+
"Ref": "HttpProxyApiD0217C67"
186+
},
187+
"RouteKey": "$default",
188+
"Target": {
189+
"Fn::Join": [
190+
"",
191+
[
192+
"integrations/",
193+
{
194+
"Ref": "HttpProxyApiDefaultRouteHttpIntegration8eeecf9ecdb91f31bebf6bd54fb711a41921AB82"
195+
}
196+
]
197+
]
198+
}
199+
}
200+
},
203201
"HttpProxyApiDefaultStageA88F9DE3": {
204202
"Type": "AWS::ApiGatewayV2::Stage",
205203
"Properties": {

0 commit comments

Comments
 (0)