Skip to content

Commit 92f02e9

Browse files
ranjith-jagadeeshranjith-jagadeesh
authored
fix(appsync): Populate construct name dynamically for lambda authorizer permission in appsync (#23777)
fixes #23434 ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Construct Runtime Dependencies: * [ ] This PR adds new construct runtime dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-construct-runtime-dependencies) ### New Features * [x] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [x] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 4613886 commit 92f02e9

12 files changed

+1009
-1
lines changed

‎packages/@aws-cdk/aws-appsync/lib/graphqlapi.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -534,7 +534,7 @@ export class GraphqlApi extends GraphqlApiBase {
534534
const config = modes.find((mode: AuthorizationMode) => {
535535
return mode.authorizationType === AuthorizationType.LAMBDA && mode.lambdaAuthorizerConfig;
536536
})?.lambdaAuthorizerConfig;
537-
config?.handler.addPermission('appsync', {
537+
config?.handler.addPermission(`${id}-appsync`, {
538538
principal: new ServicePrincipal('appsync.amazonaws.com'),
539539
action: 'lambda:InvokeFunction',
540540
});

‎packages/@aws-cdk/aws-appsync/test/appsync-auth.test.ts

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -684,6 +684,59 @@ describe('AppSync Lambda Authorization', () => {
684684

685685
});
686686

687+
test('Attach Lambda Authorization to two or more graphql api', () => {
688+
// WHEN
689+
new appsync.GraphqlApi(stack, 'api1', {
690+
name: 'api1',
691+
schema: appsync.SchemaFile.fromAsset(
692+
path.join(__dirname, 'appsync.test.graphql'),
693+
),
694+
authorizationConfig: {
695+
defaultAuthorization: {
696+
authorizationType: appsync.AuthorizationType.LAMBDA,
697+
lambdaAuthorizerConfig: {
698+
handler: fn,
699+
},
700+
},
701+
},
702+
});
703+
704+
new appsync.GraphqlApi(stack, 'api2', {
705+
name: 'api2',
706+
schema: appsync.SchemaFile.fromAsset(
707+
path.join(__dirname, 'appsync.test.graphql'),
708+
),
709+
authorizationConfig: {
710+
defaultAuthorization: {
711+
authorizationType: appsync.AuthorizationType.LAMBDA,
712+
lambdaAuthorizerConfig: {
713+
handler: fn,
714+
},
715+
},
716+
},
717+
});
718+
719+
// THEN
720+
Template.fromStack(stack).hasResourceProperties(
721+
'AWS::AppSync::GraphQLApi',
722+
{
723+
AuthenticationType: 'AWS_LAMBDA',
724+
LambdaAuthorizerConfig: {
725+
AuthorizerUri: {
726+
'Fn::GetAtt': ['authfunction96361832', 'Arn'],
727+
},
728+
},
729+
},
730+
);
731+
732+
Template.fromStack(stack).hasResourceProperties('AWS::Lambda::Permission', {
733+
Action: 'lambda:InvokeFunction',
734+
FunctionName: {
735+
'Fn::GetAtt': ['authfunction96361832', 'Arn'],
736+
},
737+
});
738+
});
739+
687740
test('Lambda authorization configurable in default authorization', () => {
688741
// WHEN
689742
new appsync.GraphqlApi(stack, 'api', {

‎packages/@aws-cdk/aws-appsync/test/integ.lambda-auth.js.snapshot/GraphQlApiLambdaAuthDefaultTestDeployAssert3A9D82EA.assets.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "29.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "GraphQlApiLambdaAuthDefaultTestDeployAssert3A9D82EA.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk/aws-appsync/test/integ.lambda-auth.js.snapshot/GraphQlApiLambdaAuthDefaultTestDeployAssert3A9D82EA.template.json

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk/aws-appsync/test/integ.lambda-auth.js.snapshot/appsync-lambda-auth.assets.json

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"version": "29.0.0",
3+
"files": {
4+
"df9f207d681056c35badb6bc0d60a945b44c887b227b759715fd6a6443486443": {
5+
"source": {
6+
"path": "asset.df9f207d681056c35badb6bc0d60a945b44c887b227b759715fd6a6443486443",
7+
"packaging": "zip"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "df9f207d681056c35badb6bc0d60a945b44c887b227b759715fd6a6443486443.zip",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
},
17+
"6318a3460f2277a0215d1d3dec988f54f73d1ebd0221c7a7cc4d2bcb6324b50f": {
18+
"source": {
19+
"path": "appsync-lambda-auth.template.json",
20+
"packaging": "file"
21+
},
22+
"destinations": {
23+
"current_account-current_region": {
24+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25+
"objectKey": "6318a3460f2277a0215d1d3dec988f54f73d1ebd0221c7a7cc4d2bcb6324b50f.json",
26+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
27+
}
28+
}
29+
}
30+
},
31+
"dockerImages": {}
32+
}

‎packages/@aws-cdk/aws-appsync/test/integ.lambda-auth.js.snapshot/appsync-lambda-auth.template.json

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
{
2+
"Resources": {
3+
"funcServiceRoleA96CCB44": {
4+
"Type": "AWS::IAM::Role",
5+
"Properties": {
6+
"AssumeRolePolicyDocument": {
7+
"Statement": [
8+
{
9+
"Action": "sts:AssumeRole",
10+
"Effect": "Allow",
11+
"Principal": {
12+
"Service": "lambda.amazonaws.com"
13+
}
14+
}
15+
],
16+
"Version": "2012-10-17"
17+
},
18+
"ManagedPolicyArns": [
19+
{
20+
"Fn::Join": [
21+
"",
22+
[
23+
"arn:",
24+
{
25+
"Ref": "AWS::Partition"
26+
},
27+
":iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
28+
]
29+
]
30+
}
31+
]
32+
}
33+
},
34+
"funcC3A0C2E2": {
35+
"Type": "AWS::Lambda::Function",
36+
"Properties": {
37+
"Code": {
38+
"S3Bucket": {
39+
"Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
40+
},
41+
"S3Key": "df9f207d681056c35badb6bc0d60a945b44c887b227b759715fd6a6443486443.zip"
42+
},
43+
"Role": {
44+
"Fn::GetAtt": [
45+
"funcServiceRoleA96CCB44",
46+
"Arn"
47+
]
48+
},
49+
"Handler": "lambda-tutorial.handler",
50+
"Runtime": "nodejs14.x"
51+
},
52+
"DependsOn": [
53+
"funcServiceRoleA96CCB44"
54+
]
55+
},
56+
"funcapi1appsync5C5BBFA1": {
57+
"Type": "AWS::Lambda::Permission",
58+
"Properties": {
59+
"Action": "lambda:InvokeFunction",
60+
"FunctionName": {
61+
"Fn::GetAtt": [
62+
"funcC3A0C2E2",
63+
"Arn"
64+
]
65+
},
66+
"Principal": "appsync.amazonaws.com"
67+
}
68+
},
69+
"funcapi2appsync0EE83EF2": {
70+
"Type": "AWS::Lambda::Permission",
71+
"Properties": {
72+
"Action": "lambda:InvokeFunction",
73+
"FunctionName": {
74+
"Fn::GetAtt": [
75+
"funcC3A0C2E2",
76+
"Arn"
77+
]
78+
},
79+
"Principal": "appsync.amazonaws.com"
80+
}
81+
},
82+
"api1A91238E2": {
83+
"Type": "AWS::AppSync::GraphQLApi",
84+
"Properties": {
85+
"AuthenticationType": "AWS_LAMBDA",
86+
"Name": "api1",
87+
"LambdaAuthorizerConfig": {
88+
"AuthorizerUri": {
89+
"Fn::GetAtt": [
90+
"funcC3A0C2E2",
91+
"Arn"
92+
]
93+
}
94+
}
95+
}
96+
},
97+
"api1SchemaFFA53DB6": {
98+
"Type": "AWS::AppSync::GraphQLSchema",
99+
"Properties": {
100+
"ApiId": {
101+
"Fn::GetAtt": [
102+
"api1A91238E2",
103+
"ApiId"
104+
]
105+
},
106+
"Definition": "type test {\n version: String!\n}\ntype Query {\n getTests: [test]!\n}\ntype Mutation {\n addTest(version: String!): test\n}\n"
107+
}
108+
},
109+
"api2C4850CEA": {
110+
"Type": "AWS::AppSync::GraphQLApi",
111+
"Properties": {
112+
"AuthenticationType": "AWS_LAMBDA",
113+
"Name": "api2",
114+
"LambdaAuthorizerConfig": {
115+
"AuthorizerUri": {
116+
"Fn::GetAtt": [
117+
"funcC3A0C2E2",
118+
"Arn"
119+
]
120+
}
121+
}
122+
}
123+
},
124+
"api2SchemaD5C26031": {
125+
"Type": "AWS::AppSync::GraphQLSchema",
126+
"Properties": {
127+
"ApiId": {
128+
"Fn::GetAtt": [
129+
"api2C4850CEA",
130+
"ApiId"
131+
]
132+
},
133+
"Definition": "type test {\n version: String!\n}\ntype Query {\n getTests: [test]!\n}\ntype Mutation {\n addTest(version: String!): test\n}\n"
134+
}
135+
}
136+
},
137+
"Parameters": {
138+
"BootstrapVersion": {
139+
"Type": "AWS::SSM::Parameter::Value<String>",
140+
"Default": "/cdk-bootstrap/hnb659fds/version",
141+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
142+
}
143+
},
144+
"Rules": {
145+
"CheckBootstrapVersion": {
146+
"Assertions": [
147+
{
148+
"Assert": {
149+
"Fn::Not": [
150+
{
151+
"Fn::Contains": [
152+
[
153+
"1",
154+
"2",
155+
"3",
156+
"4",
157+
"5"
158+
],
159+
{
160+
"Ref": "BootstrapVersion"
161+
}
162+
]
163+
}
164+
]
165+
},
166+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
167+
}
168+
]
169+
}
170+
}
171+
}

0 commit comments

Comments
 (0)