fix(apigatewayv2): authorizer is not removed when HttpNoneAuthorizer …

…is used (#14424)

CloudFormation will not remove an existing Authorizer if AuthorizationType and AuthorizerId are simply removed.  The AuthorizationType must be explicitly set to NONE for CloudFormation to remove the existing Authorizer.

As such, I updated the HttpRoute constructor to include the AuthorizationType even if it is NONE; otherwise it is impossible to remove an authorizer in CDK.  Some thought had obviously gone into this previously because of the following line:

https://github.com/aws/aws-cdk/blob/2f5eeb08f8790c73db7305cc7f85116e2730267d/packages/%40aws-cdk/aws-apigatewayv2/lib/http/route.ts#L159

I did not manage to track down the reasoning for this in commit comments, so I would be interested to hear why this was done, since I may have overlooked a desired use case.  I'm wondering if it was assumed that the default CloudFormation value for AuthorizationType is NONE, so to have a more compact template it was omitted.  However, the behavior when AuthorizationType is not present, is to not change the existing Authorizer.

Basically in the CloudFormation template,

```yaml
  APIGETintegrationgoogleapiregister1D8736BD:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId:
        Ref: API62EA1CEE
      RouteKey: GET /integration/google-api/register
      Target: ...
```

does not have the same effect as

```yaml
  APIGETintegrationgoogleapiregister1D8736BD:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId:
        Ref: API62EA1CEE
      RouteKey: GET /integration/google-api/register
      AuthorizationType: NONE
      Target: ...
```

Only the later will remove an existing Authorizer.

If you think this is a bug in CloudFormation and not its intended behavior, please let me know.  I am assuming that they would not change the behavior anyway since that could have unintended consequence for anyone who redeploys a template without the AuthorizationType set.

BREAKING CHANGE: setting the authorizer of an API route to HttpNoneAuthorizer will now remove any existing authorizer on the route

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/integ.alb.expected.json

@@ -633,6 +633,7 @@
           "Ref": "HttpProxyPrivateApiA55E154D"
         },
         "RouteKey": "$default",
+        "AuthorizationType": "NONE",
         "Target": {
           "Fn::Join": [
             "",

packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/integ.http-proxy.expected.json

@@ -117,6 +117,7 @@
           "Ref": "LambdaProxyApi67594471"
         },
         "RouteKey": "$default",
+        "AuthorizationType": "NONE",
         "Target": {
           "Fn::Join": [
             "",
@@ -185,6 +186,7 @@
           "Ref": "HttpProxyApiD0217C67"
         },
         "RouteKey": "$default",
+        "AuthorizationType": "NONE",
         "Target": {
           "Fn::Join": [
             "",

packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/integ.lambda-proxy.expected.json

@@ -117,6 +117,7 @@
           "Ref": "LambdaProxyApi67594471"
         },
         "RouteKey": "$default",
+        "AuthorizationType": "NONE",
         "Target": {
           "Fn::Join": [
             "",

packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/integ.nlb.expected.json

@@ -598,6 +598,7 @@
           "Ref": "HttpProxyPrivateApiA55E154D"
         },
         "RouteKey": "$default",
+        "AuthorizationType": "NONE",
         "Target": {
           "Fn::Join": [
             "",

packages/@aws-cdk/aws-apigatewayv2-integrations/test/http/integ.service-discovery.expected.json

@@ -602,6 +602,7 @@
           "Ref": "HttpProxyPrivateApiA55E154D"
         },
         "RouteKey": "$default",
+        "AuthorizationType": "NONE",
         "Target": {
           "Fn::Join": [
             "",

packages/@aws-cdk/aws-apigatewayv2/lib/http/route.ts

@@ -156,8 +156,6 @@ export class HttpRoute extends Resource implements IHttpRoute {
       ]));
     }
 
-    const authorizationType = authBindResult?.authorizationType === HttpAuthorizerType.NONE ? undefined : authBindResult?.authorizationType;
-
     if (authorizationScopes?.length === 0) {
       authorizationScopes = undefined;
     }
@@ -167,7 +165,7 @@ export class HttpRoute extends Resource implements IHttpRoute {
       routeKey: props.routeKey.key,
       target: `integrations/${integration.integrationId}`,
       authorizerId: authBindResult?.authorizerId,
-      authorizationType,
+      authorizationType: authBindResult?.authorizationType ?? HttpAuthorizerType.NONE, // must be explicitly NONE (not undefined) for stack updates to work correctly
       authorizationScopes,
     };
 

packages/@aws-cdk/aws-apigatewayv2/test/http/api.test.ts

@@ -429,6 +429,7 @@ describe('HttpApi', () => {
 
       expect(stack).toHaveResource('AWS::ApiGatewayV2::Route', {
         RouteKey: 'GET /chickens',
+        AuthorizationType: 'NONE',
         AuthorizerId: ABSENT,
       });
     });

packages/@aws-cdk/aws-apigatewayv2/test/http/route.test.ts

@@ -30,6 +30,7 @@ describe('HttpRoute', () => {
           ],
         ],
       },
+      AuthorizationType: 'NONE',
     });
 
     expect(stack).toHaveResource('AWS::ApiGatewayV2::Integration', {

packages/@aws-cdk/aws-stepfunctions-tasks/test/apigateway/integ.call-http-api.expected.json

@@ -77,6 +77,7 @@
           "Ref": "MyHttpApi8AEAAC21"
         },
         "RouteKey": "ANY /",
+        "AuthorizationType": "NONE",
         "Target": {
           "Fn::Join": [
             "",