aws / aws/serverless-application-model
ApiGatewayDeployment.make_auto_deployable does not account for API Stage Variables
- Dominant language
- Python
- Stars
- 9.6k
- Forks
- 2.5k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 7
Description
Stage variable updates will cause an API Gateway UpdateStage call during SAM API stack deployment. However, since API Stage variables are not considered as hash input to ApiGatewayDeployment.make_auto_deployable, an update to a SAM API Stage can be made without a new deployment.
https://github.com/aws/serverless-application-model/blob/17000c195d65a41ee830173e7110ad2c36078a7a/samtranslator/model/apigateway.py#L95-L103
This means
1. The API Stage variables updates are not 'deployed',
2. UpdateStage will reset the Active API Deployment to it's last known good API Deployment ID. **If you have made other non-SAM managed deployments since your last SAM managed deployment, a latest change with just API Stage Variable changes will revert the active deployment Id to the last known good deployment**. This effectively reverts your latest changes made outside of the SAM managed changes.
----
My team uses scripts to adjust the API Resource Policy (to onboard new clients), then deploy those authz changes using create-deployment, The above issue 2) recently caused an issue where our latest onboarding Resource Policy changes were no longer active after an API Stage Variable only change SAM deployment
REPRO:
1. Deploy SAM Api
2. Manually update the API Resource Policy
3. Manually deploy the API
4. Update SAM definition to add / change an API Stage Variable
5. Deploy the updated SAM definition
OBSERVE:
1. Step 5) creates an CFN Changeset with the update to the API Stage variables.
2. Processing that change set produces a Cloud Trail UpdateState Event where you can see both the new variable details, ,but also the 'reset' of the deploymnent value to something old.
IMPACT:
Your manual policy update step 2) is no longer active.
Contributor guide
Assessment
This issue has not been assessed yet.