aws / aws/serverless-application-model

Invoke with caller credentials always set when Authorizer = AWS_IAM

Open
#1,708 3 comments 4 reactions 0 assignees View on GitHub
maintainer/need-response type/feature
Dominant language
Python
Stars
9.6k
Forks
2.5k
Avg merge
1d 11h
Merged PRs (30d)
7

Description

I have the following template (default Empty Serverless Application template from AWS Visual Studio Toolkit) that always sets the `Invoke with caller credentials to true` and `Execution role = arn:aws:iam::*:user/*` when `Authorizer = AWS_IAM ` in the template. Is there any way I can remove the Execution role and set `Invoke with caller credentials = false`?

```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Transform": "AWS::Serverless-2016-10-31",
"Description": "An AWS Serverless Application.",
"Resources": {
"Get": {
"Type": "AWS::Serverless::Function",
"Properties": {
"Handler": "AWSServerless6::AWSServerless6.Functions::Get",
"Runtime": "dotnetcore3.1",
"CodeUri": "",
"MemorySize": 256,
"Timeout": 30,
"Role": null,
"Policies": [
"AWSLambdaBasicExecutionRole"
],
"Events": {
"RootGet": {
"Type": "Api",
"Properties": {
"Path": "/",
"Method": "POST",
"Auth": {
"ApiKeyRequired": true,
"Authorizer": "AWS_IAM"
}
}
}
}
}
},
"Outputs": {
"ApiURL": {
"Description": "API endpoint URL for Prod environment",
"Value": {
"Fn::Sub": "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Prod/"
}
}
}
}
```

This may be related to #923

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.