aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::ApiGateway::Stage] - [Enhancement] - Add return value for Stage ARN
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::ApiGateway::Stage
### Resource name
_No response_
### Description
Hello team,
if the AWS::WAFv2::WebACLAssociation resource does not have a DependsOn attribute for the AWS::ApiGateway::Stage resource then the WebACLAssociation resource would fail to create with error:
```
"AWS WAF couldn't perform the operation because your resource doesn't exist"
```
Only when the DependsOn was specified (as shown in the snippet below) will the deployment be successful:
```
MyProdStage:
Type: AWS::ApiGateway::Stage
Properties:
StageName: prod
RestApiId: !Ref MyRestApi
DeploymentId: !Ref MyProdDeployment
MyWebACLAssociation:
Type: AWS::WAFv2::WebACLAssociation
DependsOn: MyProdStage #<-- this is required
Properties:
ResourceArn: !Sub arn:aws:apigateway:${AWS::Region}::/restapis/${MyRestApi}/stages/prod
WebACLArn: arn:aws:wafv2:us-east-1:0405xxxx7873:regional/webacl/regional/e5c86a68-10ed-4223-807f-bbb0a178afb2
```
One way to prevent the error above is to add an implicit dependency. Currently the APIGW stage resource has a return value !Ref which returns the stage name.
Using this and !Join, was able to generate the resource ARN with !Ref MyProdStage as follows:
```
MyWebACLAssociation:
Type: AWS::WAFv2::WebACLAssociation
Properties:
ResourceArn: !Join
- ''
- - !Sub 'arn:aws:apigateway:${AWS::Region}::/restapis/'
- !Ref MyRestApi
- '/stages/'
- !Ref MyProdStage
WebACLArn: arn:aws:wafv2:us-east-1:230663520265:regional/webacl/restapiwaf/54ad8b47-02a9-4d1d-bf61-c719ca5112f3
```
While this implicit workaround works, creating this enhancement request to have a return value (!GetAtt) for the APIGW Stage resource that returns the Stage ARN. This would make it simpler in the future to add an implicit dependency to the ResourceArn property of the WebACLAssociation (such that it would look along the lines of ResourceArn: !GetAtt MyProdStage.Arn) instead of using !Join.
Contributor guide
Research direction
Review the AWS::ApiGateway::Stage and AWS::WAFv2::WebACLAssociation behavior described here, starting with the existing !Ref return value and the documented Stage ARN format. Done means the Stage resource exposes its ARN through !GetAtt so ResourceArn can reference it directly and create the needed implicit dependency.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100