refactor(apigateway): authorization models #1995
Conversation
| "Values" : ["IP", "SIG4ORIP", "SIG4ANDIP"], | ||
| "Values" : [ | ||
| "IP", | ||
| "SIG4ORIP", "SIG4_OR_IP", |
There was a problem hiding this comment.
Should SIG4 move to the aws provider as an extension attribute? Its very specific to AWS
There was a problem hiding this comment.
Probably but it has been like that so long removing it would require a breaking change.
There was a problem hiding this comment.
I could make the others I'm adding AWS specific and leave the unhyphenated ones as is?
There was a problem hiding this comment.
I've moved the new SIG4_* values to the AWS provider and prefixed them. We can plan to remove the shared values in a future breaking change - #1997
There was a problem hiding this comment.
You can also add shared: in the aws provider to keep them using the existing value while also adding the prefixed version
Has an example of that for the awsvpc network mode on containers
ml019
force-pushed
the
refactor-api-gateway-resource-policies
branch
2 times, most recently
from
951e276 to
30e60b7
Compare
Support additional values for the case of IP filtering in combination with a lambda authorizer. Also rename the config attribute to more correctly reflect its purpose in controlling authorization rather than authentication. When used with a lambda authorizer, the default value of "IP" incorrectly provides an explict ALLOW rather than relying on it to come from the policy provided by the authorizer. By providing explicit values to be used with the authorizer, the configuration can be validated as appropriate.
Add description of the AuthorisationModel attribute.
As SIG4 is very AWS specific, move all SIG4 related values to the AWS provider. The non-prefixed variant will still be included for backwards compatability. With the new prefixed AWS values in place, a future breaking change can remove the non-prefixed SIG4 specific values from the AWS provider.
ml019
force-pushed
the
refactor-api-gateway-resource-policies
branch
from
30e60b7 to
28b8aef
Compare
Intent of Change
Description
Support additional model values for the case of IP filtering in combination with a lambda authorizer. Also rename the config attribute to more correctly reflect its purpose in controlling authorization rather than authentication.
Motivation and Context
When used with a lambda authorizer, the default value of "IP" incorrectly provides an explict ALLOW rather than relying on it to come from the policy provided by the authorizer. By providing explicit values to be used with the authorizer, the configuration can be validated as appropriate.
How Has This Been Tested?
Local template generation
Related Changes
Prerequisite PRs:
Dependent PRs:
Consumer Actions: