aws / aws/aws-cdk

aws-apigatewayv2-authorizers: Expose the node or HttpAuthorizer resource for dependency management

Open
#28,061 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-apigatewayv2-authorizers effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

Expose the Node construct of the Authorizer for `HttpJwtAuthorizer` and the other authorizers in the `@aws-cdk/aws-apigatewayv2-authorizers-alpha` package.

### Use Case

This is only really an issue for the JWT authorizer resources, and if you are self exposing the openid configuration via the same API Gateway, as at creation time, it calls the `/.well-known/openid-configuration` endpoint, and you get the following error:

```
Error: Invalid issuer: https://{DOMAIN}. Issuer must have a valid discovery endpoint ended with '/.well-known/openid-configuration'
```

There is a workaround:

```ts
const certificate = new aws_certificatemanager.Certificate(
stack,
"Certificate",
{
domainName: fqdn,
certificateName: fqdn,
validation: aws_certificatemanager.CertificateValidation.fromDns(zone),
}
);

const domain = new aws_apigatewayv2.DomainName(stack, "Domain", {
domainName: fqdn,
certificate,
});

const api = new aws_apigatewayv2.HttpApi(stack, "Api", {
apiName: fqdn,
defaultDomainMapping: {
domainName: domain,
},
corsPreflight: {
allowMethods: [
aws_apigatewayv2.CorsHttpMethod.GET,
aws_apigatewayv2.CorsHttpMethod.POST,
aws_apigatewayv2.CorsHttpMethod.OPTIONS,
],
allowOrigins: [
`https://dashboard.${zone.zoneName}`,
"http://localhost:5173",
],
allowHeaders: ["content-type"],
maxAge: Duration.days(10),
},
});
const dnsRecord = new aws_route53.ARecord(stack, "ARecord", {
zone,
recordName: fqdn,
target: aws_route53.RecordTarget.fromAlias(
new aws_route53_targets.ApiGatewayv2DomainProperties(
domain.regionalDomainName,
domain.regionalHostedZoneId
)
),
});

const integration = new aws_apigatewayv2_integrations.HttpLambdaIntegration(
"ApiIntegration",
apiLambda,
{
payloadFormatVersion: aws_apigatewayv2.PayloadFormatVersion.VERSION_2_0,
}
);

const [openIdRoute] = api.addRoutes({
path: "/.well-known/openid-configuration",
methods: [aws_apigatewayv2.HttpMethod.GET],
integration,
});
const [jwksRoute] = api.addRoutes({
path: "/.well-known/jwks.json",
methods: [aws_apigatewayv2.HttpMethod.GET],
integration,
});

// Routes for Authentication, no auth required
api.addRoutes({
path: "/auth/rpc",
methods: [aws_apigatewayv2.HttpMethod.POST],
integration,
});

// Authenticated Routes, requires JWT Bearer token
const authorizer = new aws_apigatewayv2_authorizers.HttpJwtAuthorizer(
"Authorizer",
authUrl,
{
authorizerName: "jwt-authorizer",
jwtAudience: [authUrl],
identitySource: ["$request.header.Authorization"],
}
);
api.addRoutes({
path: "/rpc",
methods: [aws_apigatewayv2.HttpMethod.POST],
integration,
authorizer,
authorizationScopes: ["authorized"],
});

// We can't create the authorized routes until the config routes are created
// This doesn't exist until used in a route, which is created via bind().
const authorizerResource: aws_apigatewayv2.HttpAuthorizer =
// @ts-expect-error Not exposed for dependency
authorizer.authorizer;

// We need the lambda to be reachable before creating the JWT Authorizer
authorizerResource.node.addDependency(dnsRecord, openIdRoute, jwksRoute);
```

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.110.0 + @aws-cdk/aws-apigatewayv2-*: ^2.110.0-alpha.0

### Environment details (OS name and version, etc.)

Windows 11 Pro Insider 25992

Contributor guide

Open the contributing guide

Research direction

Start in the @aws-cdk/aws-apigatewayv2-authorizers-alpha package with HttpJwtAuthorizer and the other authorizer constructs, then trace how the underlying HttpAuthorizer is created during bind(). Expose the resource needed for dependency management and verify that the documented JWT discovery-route workaround can add dependencies without accessing a private member.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
api, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.