aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::ApiGateway::Stage] - [Enhancement] - Add return value for Stage ARN

Open
#2,358 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::ApiGateway::Stage

### Resource name

_No response_

### Description

Hello team,

if the AWS::WAFv2::WebACLAssociation resource does not have a DependsOn attribute for the AWS::ApiGateway::Stage resource then the WebACLAssociation resource would fail to create with error:
```
"AWS WAF couldn't perform the operation because your resource doesn't exist"
```

Only when the DependsOn was specified (as shown in the snippet below) will the deployment be successful:
```
MyProdStage:
Type: AWS::ApiGateway::Stage
Properties:
StageName: prod
RestApiId: !Ref MyRestApi
DeploymentId: !Ref MyProdDeployment

MyWebACLAssociation:
Type: AWS::WAFv2::WebACLAssociation
DependsOn: MyProdStage #<-- this is required
Properties:
ResourceArn: !Sub arn:aws:apigateway:${AWS::Region}::/restapis/${MyRestApi}/stages/prod
WebACLArn: arn:aws:wafv2:us-east-1:0405xxxx7873:regional/webacl/regional/e5c86a68-10ed-4223-807f-bbb0a178afb2
```

One way to prevent the error above is to add an implicit dependency. Currently the APIGW stage resource has a return value !Ref which returns the stage name.

Using this and !Join, was able to generate the resource ARN with !Ref MyProdStage as follows:
```
MyWebACLAssociation:
Type: AWS::WAFv2::WebACLAssociation
Properties:
ResourceArn: !Join
- ''
- - !Sub 'arn:aws:apigateway:${AWS::Region}::/restapis/'
- !Ref MyRestApi
- '/stages/'
- !Ref MyProdStage
WebACLArn: arn:aws:wafv2:us-east-1:230663520265:regional/webacl/restapiwaf/54ad8b47-02a9-4d1d-bf61-c719ca5112f3
```

While this implicit workaround works, creating this enhancement request to have a return value (!GetAtt) for the APIGW Stage resource that returns the Stage ARN. This would make it simpler in the future to add an implicit dependency to the ResourceArn property of the WebACLAssociation (such that it would look along the lines of ResourceArn: !GetAtt MyProdStage.Arn) instead of using !Join.

Contributor guide

Open the contributing guide

Research direction

Review the AWS::ApiGateway::Stage and AWS::WAFv2::WebACLAssociation behavior described here, starting with the existing !Ref return value and the documented Stage ARN format. Done means the Stage resource exposes its ARN through !GetAtt so ResourceArn can reference it directly and create the needed implicit dependency.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.