(apigatewayv2): IAM Permissions not being created for Api Gateway to access http lambda integration

[kevinmcgillicuddy]

What is the problem?

API gateway does not create needed IAM roles to connect to an HTTP Lambda integration, this started when upgrading to CDK v2

Reproduction Steps

When using AWS-CDK 2.3.0-alpha.0

"@aws-cdk/aws-apigatewayv2-alpha": "2.3.0-alpha.0",
"@aws-cdk/aws-apigatewayv2-authorizers-alpha": "^2.3.0-alpha.0",
"@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.3.0-alpha.0"

We have 2 routes that point to the same integration, permissions in cloudformation are only created for the first one

const jobsIntegration = new apiGatewayIntegrations.HttpLambdaIntegration('JobsIntegration', jobsFunction);

  props.httpApi.addRoutes({
    path: '/hr/jobs',
    methods: [ apiGateway.HttpMethod.GET ],
    integration: jobsIntegration,
    authorizer: props.Authorizer
  });

  props.httpApi.addRoutes({
    path: '/hr/job/{reqId}',
    methods: [ apiGateway.HttpMethod.GET ],
    integration: jobsIntegration,
    authorizer: props.Authorizer
  });

cloudformation:

    "HttpApiGEThrjobsJobsIntegrationPermissionFFAB51F1": {
      "Type": "AWS::Lambda::Permission",
      "Properties": {
        "Action": "lambda:InvokeFunction",
        "FunctionName": {
          "Fn::ImportValue": "OutputFnGetAttJobsFunction382FBD18Arn3EEB55F3"
        },
        "Principal": "apigateway.amazonaws.com",
        "SourceArn": {
          "Fn::Join": [
            "",
            [
              "arn:",
              {
                "Ref": "AWS::Partition"
              },
              ":execute-api:us-east-1:123:",
              {
                "Ref": "HttpApiF5A9A8A7"
              },
              "/*/*/hr/jobs"
            ]
          ]
        }
      },
      "Metadata": {
        "aws:cdk:path": "/ApiGateway/HttpApi/GET--hr--jobs/JobsIntegration-Permission"
      }

API gateway access logs:

   {
    "requestId": "=",
    "ip": "",
    "requestTime": "28/Dec/2021:16:25:46 +0000",
    "httpMethod": "GET",
    "routeKey": "GET /hr/job/{reqId}",
    "status": "500",
    "protocol": "HTTP/1.1",
    "responseLength": "35",
    "contenxtError": "Internal Server Error",
    "integrationErrorMessage": "The IAM role configured on the integration or API Gateway doesn't have permissions to call the integration. Check the permissions and try again."
}

What did you expect to happen?

It to create permissions for both routes

What actually happened?

It only created for the first route - see above cloudformation output

work around is as follows - create a new integration linked to the same function

 const jobsIntegration = new apiGatewayIntegrations.HttpLambdaIntegration('JobsIntegration', jobsFunction);
 **const jobIntegration = new apiGatewayIntegrations.HttpLambdaIntegration('JobIntegration', jobsFunction);**

   props.httpApi.addRoutes({
     path: '/hr/jobs',
     methods: [ apiGateway.HttpMethod.GET ],
     integration: jobsIntegration,
     authorizer: props.Authorizer
   });

   props.httpApi.addRoutes({
     path: '/hr/job/{reqId}',
     methods: [ apiGateway.HttpMethod.GET ],
     integration: **jobIntegration** ,
     authorizer: props.Authorizer
   });

CDK CLI Version

2.3.0

Framework Version

No response

Node.js Version

14.18.0

OS

Windows 11

Language

Typescript

Language Version

4.5.2

Other information

No response

[nanto]

I got the same problem on CDK v1.137.0. The following workaround (calling integration.bind method explicitly) works for me.

import { HttpApi, HttpMethod } from "@aws-cdk/aws-apigatewayv2";
import { HttpLambdaIntegration } from "@aws-cdk/aws-apigatewayv2-integrations";

const api = new HttpApi(...);
const integration = new HttpLambdaIntegration(...);
api.addRoutes({
  path: '/foo',
  methods: [HttpMethod.GET],
  integration,
});
const [barRoute] = api.addRoutes({
  path: '/bar',
  methods: [HttpMethod.GET],
  integration,
});
integration.bind({ route: barRoute, scope: barRoute });

[tmokmss]

WebSocket API also has the same issue #18208.
Currently it seems we cannot share the same integration instance with multiple routes.

Another workaround is to create an integration instance per route.

Since we are calling bind only once per integration instance, it isn't possible to reuse a single integration instance for multiple routes.

aws-cdk/packages/@aws-cdk/aws-apigatewayv2/lib/websocket/integration.ts

Lines 112 to 113 in 626e6aa

	if (!this.integration) {
	const config = this.bind(options);

[andrei-cdl]

This might be related, but I also have similar behavior after updating from 1.134.0 to 1.139.0. I have 2 routes added to an httpGateway.

however only 1 route is added to the lambda trigger (the first one listed).

i.e

gateway.addRoutes({
    path: '/user',
    methods: [HttpMethod.ANY],
    integration: userFnProxy,
  });

  gateway.addRoutes({
    path: '/user/{proxy+}',
    methods: [HttpMethod.ANY],
    integration: userFnProxy,
  });

it no longer adds the {proxy+} which is not the correct behavior but makes sense as to why it's not created the IAM permissions in your case as well since the second route isn't being added. (I only noticed this because I deleted all routes to the lambda and redeployed, the second route is missing in aws console now as shown in the image there should be 2 triggers.

[fullstackcreatives]

Same issue here after upgrading to cdk v2 and to "@aws-cdk/aws-apigatewayv2-integrations-alpha" I get

"The IAM role configured on the integration or API Gateway doesn't have permissions to call the integration. Check the permissions and try again"

for all routes but the first one.

If you create a "HttpLambdaIntegration" for each route it works. Is this the expected behaviour?

[andrei-cdl]

@fullstackcreatives it works if you define multiple HttpLambdaIntegrations?

i.e

  const userFnBase = new LambdaProxyIntegration({ handler: userFn })  // renamed to HttpLambdaIntegration > 1.137
  gateway.addRoutes({
    path: '/user',
    methods: [HttpMethod.ANY],
    integration: userFnBase,
  });
  
  const userFnProxy = new LambdaProxyIntegration({ handler: userFn })
  gateway.addRoutes({
    path: '/user/{proxy+}',
    methods: [HttpMethod.ANY],
    integration: userFnProxy,
  });

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.