{"action":"created","issue":{"url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/66","repository_url":"https://api.github.com/repos/awslabs/serverless-application-model","labels_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/66/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/66/comments","events_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/66/events","html_url":"https://github.com/awslabs/serverless-application-model/issues/66","id":202209873,"number":66,"title":"Custom Authorizer Function ARN within Swagger File","user":{"login":"marjanSterjev","id":9569027,"avatar_url":"https://avatars3.githubusercontent.com/u/9569027?v=3","gravatar_id":"","url":"https://api.github.com/users/marjanSterjev","html_url":"https://github.com/marjanSterjev","followers_url":"https://api.github.com/users/marjanSterjev/followers","following_url":"https://api.github.com/users/marjanSterjev/following{/other_user}","gists_url":"https://api.github.com/users/marjanSterjev/gists{/gist_id}","starred_url":"https://api.github.com/users/marjanSterjev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marjanSterjev/subscriptions","organizations_url":"https://api.github.com/users/marjanSterjev/orgs","repos_url":"https://api.github.com/users/marjanSterjev/repos","events_url":"https://api.github.com/users/marjanSterjev/events{/privacy}","received_events_url":"https://api.github.com/users/marjanSterjev/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-01-20T18:29:20Z","updated_at":"2017-04-21T21:11:33Z","closed_at":"2017-01-26T20:46:27Z","body":"We have the following scenario: \r\n\r\nWe want with single Cloud Formation stack to deploy an API Gateway having methods secured with Lambda based Custom Authorizer. The API must be defined with Swagger file.\r\n\r\nThe Custom Authorizer Lambda must be created within the same Cloud Formation stack.  The question is if or how we can reference the Custom Authorizer Lambda function within the Swagger file?\r\n\r\nFor example:\r\n\r\n```\r\nsecurityDefinitions:\r\n  OktaCustomAuthorizer:\r\n    type: \"apiKey\"\r\n    name: \"Authorization\"\r\n    in: \"header\"\r\n    x-amazon-apigateway-authtype: \"custom\"\r\n    x-amazon-apigateway-authorizer:\r\n      authorizerResultTtlInSeconds: 300\r\n      authorizerUri: \"arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/<<FUNCTION_ARN>>/invocations\"\r\n      type: \"token\"\r\n```\r\n\r\nIf Authorizer Lambda have been created previously, we can statically reference it in the construct above. However, what if Custom Authorizer function is part of the current stack? The API method Lambda request integrations can handle these kind of scenarios with stage variables substitutions, i.e. ${stageVariables.LambdaFunctionName}. But for Custom Authorizers it is not the case.\r\n\r\nAny opinion? The requirement for having everything in one stack seems very reasonable.\r\n\r\nBest Regards,\r\n"},"comment":{"url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/comments/296306636","html_url":"https://github.com/awslabs/serverless-application-model/issues/66#issuecomment-296306636","issue_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/66","id":296306636,"user":{"login":"brunomorency","id":98879,"avatar_url":"https://avatars1.githubusercontent.com/u/98879?v=3","gravatar_id":"","url":"https://api.github.com/users/brunomorency","html_url":"https://github.com/brunomorency","followers_url":"https://api.github.com/users/brunomorency/followers","following_url":"https://api.github.com/users/brunomorency/following{/other_user}","gists_url":"https://api.github.com/users/brunomorency/gists{/gist_id}","starred_url":"https://api.github.com/users/brunomorency/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brunomorency/subscriptions","organizations_url":"https://api.github.com/users/brunomorency/orgs","repos_url":"https://api.github.com/users/brunomorency/repos","events_url":"https://api.github.com/users/brunomorency/events{/privacy}","received_events_url":"https://api.github.com/users/brunomorency/received_events","type":"User","site_admin":false},"created_at":"2017-04-21T21:11:33Z","updated_at":"2017-04-21T21:11:33Z","body":"I have a similar setup and it works as expected:\r\n\r\nSAM Template has (under `Resources:`):\r\n```yaml\r\nResources:\r\n  AuthorizerFn:\r\n    Type: AWS::Serverless::Function\r\n    Properties:\r\n      Handler: index.handler\r\n      Runtime: nodejs6.10\r\n      CodeUri: <URI>\r\n      FunctionName: my-request-authorizer-fn\r\n  MyApi:\r\n    Type: AWS::Serverless::Api\r\n    Properties:\r\n      StageName: prod\r\n      DefinitionUri: swagger.yaml\r\n      Variables:\r\n        AuthorizerFnName: !Ref AuthorizerFn\r\n```\r\n\r\nThen in my swagger file:\r\n```yaml\r\nsecurityDefinitions:\r\n  MyCustomAuthorizer:\r\n    type: apiKey\r\n    name: Authorization\r\n    in: header\r\n    x-amazon-apigateway-authtype: custom\r\n    x-amazon-apigateway-authorizer:\r\n      authorizerResultTtlInSeconds: 300\r\n      authorizerUri: !Sub arn:aws:apigateway:<REGION>:lambda:path/2015-03-31/functions/arn:aws:lambda:<REGION>:<ACCOUNT>:function:${stageVariables.AuthorizerFnName}/invocations\r\n      type: token\r\n```\r\n\r\nAll requests on resources and methods this authorizer is enabled on are indeed authorized."}}
{"actor":{"display_login":"brunomorency"}}