aws / aws/serverless-application-model

ApiGatewayDeployment.make_auto_deployable does not account for API Stage Variables

Open
#3,703 2 comments 0 reactions 0 assignees View on GitHub
stage/bug-repro type/bug
Dominant language
Python
Stars
9.6k
Forks
2.5k
Avg merge
1d 11h
Merged PRs (30d)
7

Description

Stage variable updates will cause an API Gateway UpdateStage call during SAM API stack deployment. However, since API Stage variables are not considered as hash input to ApiGatewayDeployment.make_auto_deployable, an update to a SAM API Stage can be made without a new deployment.

https://github.com/aws/serverless-application-model/blob/17000c195d65a41ee830173e7110ad2c36078a7a/samtranslator/model/apigateway.py#L95-L103

This means

1. The API Stage variables updates are not 'deployed',
2. UpdateStage will reset the Active API Deployment to it's last known good API Deployment ID. **If you have made other non-SAM managed deployments since your last SAM managed deployment, a latest change with just API Stage Variable changes will revert the active deployment Id to the last known good deployment**. This effectively reverts your latest changes made outside of the SAM managed changes.

----
My team uses scripts to adjust the API Resource Policy (to onboard new clients), then deploy those authz changes using create-deployment, The above issue 2) recently caused an issue where our latest onboarding Resource Policy changes were no longer active after an API Stage Variable only change SAM deployment

REPRO:
1. Deploy SAM Api
2. Manually update the API Resource Policy
3. Manually deploy the API
4. Update SAM definition to add / change an API Stage Variable
5. Deploy the updated SAM definition

OBSERVE:
1. Step 5) creates an CFN Changeset with the update to the API Stage variables.
2. Processing that change set produces a Cloud Trail UpdateState Event where you can see both the new variable details, ,but also the 'reset' of the deploymnent value to something old.

IMPACT:
Your manual policy update step 2) is no longer active.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.