(API Gateway): (Authorizer must be attached to a RestApi.)

[awsrookie18]

Describe the bug

Getting the above error

const hostedZone = route53.HostedZone.fromHostedZoneAttributes(
   stack,
   `${environmentProps.environmentName}-${uniqueId}-route53-zone-${domainDetails.name}`,
   {
     zoneName: domainDetails.hostedZoneName,
     hostedZoneId: domainDetails.hostedZoneId
   }
 );
 // AWS Certificate Manager will generate a certificate for the front end domain name. Ownership
 // is validated via DNS validation method.
 const certificate = new acm.DnsValidatedCertificate(
   stack,
   `${environmentProps.environmentName}-${uniqueId}-acm-cert${domainDetails.hostedZoneName}`,
   {
     domainName,
     hostedZone,
     region: environmentProps.env?.region
   }
 );

 // Create a REST API
 const restApi = new apigateway.RestApi(
   stack,
   `${domainDetails.hostedZoneName}-${environmentProps.environmentName}-${uniqueId}-rest-api-id`,
   {
     domainName: {
       domainName,
       certificate,
       securityPolicy: apigateway.SecurityPolicy.TLS_1_2
     }
   }
 );

 // Create an A record for the domain
 new route53.ARecord(
   stack,
   `${domainDetails.hostedZoneName}-${environmentProps.environmentName}-route53-${uniqueId}-Arecord`,
   {
     recordName: domainName,
     target: route53.RecordTarget.fromAlias(new targets.ApiGateway(restApi)),
     zone: hostedZone
   }
 );
 return restApi;



 const domainName = `api.sharedservice.${guardianDetails.hostedZoneName}`.replace(/\//g, '');

 // This will create the custom api gateway based on the domain name.
 const restApi = createCustomApiGateway(guardianDetails, stack, environmentProps, domainName, 'shared-service');

 const sessionAuthorizerPropsDetails: any = {
   namespace: stage,
   isProduction: environmentProps.accountEnvProps.isProduction,
   productName: Constants.SessionTableProductName,
   region: environmentProps.accountEnvProps.env.region,
   account: environmentProps.accountEnvProps.env.account,
   cookieName: Constants.sessionToken
 };

 // New function which creates authorizer for us.
 const sessionAuthorizerDetail = createSessionAuthorizer(stack, sessionAuthorizerPropsDetails);

 // Attach the authorizer which is created in portal gateway
 /* eslint-disable camelcase */
 const authorizer = new apiGateway.RequestAuthorizer(
   stack,
   `${environmentProps.environmentName}-bffpk-authorizer-api`,
   {
     handler: sessionAuthorizerDetail.lambdaApiAuthorizer as unknown as IFunction,
     /* eslint-disable camelcase */
     identitySources: sessionAuthorizerDetail.identitySources,
     
     resultsCacheTtl: Duration.seconds(0) // Disable cache on authorizer
   }
 );

 // lambda function
 const featureFlagFunction = new CustomNodejsFunction(
   stack,
   `${environmentProps.environmentName}-lambda-feature-flag-function`,
   {
     entry: path.join(__dirname, '../../../../functions/api/sharedservices/featureflag/src/feature-flag-handler.ts'),
     architecture: Architecture.ARM_64,
     timeout: Duration.seconds(30),
     runtime: Runtime.NODEJS_18_X,
     memorySize: lambdaMemoryValue,
     ephemeralStorageSize: Size.mebibytes(lambdaEphemeralStorageValue),
     role,
     handler: 'featureflag',
     environment: { ...environment, FUNCTION_NAME: 'feature-flag-handler' }
   },
   props.envProps
 );

 // Grant decrypt permission to the lambda function
 props.launchDarklyKmsKey.grantDecrypt(featureFlagFunction);

 // Add an integration with the Lambda function
 const featureFlagResource = restApi.root.addResource('featureflag');

 // Add method along with integration lambda with api gateway
 featureFlagResource.addMethod('POST', new apiGateway.LambdaIntegration(featureFlagFunction), {
   authorizer,
   authorizationType: AuthorizationType.CUSTOM
 });

Note - createSessionAuthorizer is coming from separate package.

Error: Resolution error: Resolution error: Resolution error: Authorizer
must be attached to a RestApi.
Object creation stack:
at Execute again with CDK_DEBUG=true to capture stack traces..

Expected Behavior

Authorizer should be attached to Api gateway.

Current Behavior

It is failing with Authorizer must be attached to a RestApi.

Reproduction Steps

Provided the code above.

const hostedZone = route53.HostedZone.fromHostedZoneAttributes(
    stack,
    `${environmentProps.environmentName}-${uniqueId}-route53-zone-${domainDetails.name}`,
    {
      zoneName: domainDetails.hostedZoneName,
      hostedZoneId: domainDetails.hostedZoneId
    }
  );
  // AWS Certificate Manager will generate a certificate for the front end domain name. Ownership
  // is validated via DNS validation method.
  const certificate = new acm.DnsValidatedCertificate(
    stack,
    `${environmentProps.environmentName}-${uniqueId}-acm-cert${domainDetails.hostedZoneName}`,
    {
      domainName,
      hostedZone,
      region: environmentProps.env?.region
    }
  );

  // Create a REST API
  const restApi = new apigateway.RestApi(
    stack,
    `${domainDetails.hostedZoneName}-${environmentProps.environmentName}-${uniqueId}-rest-api-id`,
    {
      domainName: {
        domainName,
        certificate,
        securityPolicy: apigateway.SecurityPolicy.TLS_1_2
      }
    }
  );

  // Create an A record for the domain
  new route53.ARecord(
    stack,
    `${domainDetails.hostedZoneName}-${environmentProps.environmentName}-route53-${uniqueId}-Arecord`,
    {
      recordName: domainName,
      target: route53.RecordTarget.fromAlias(new targets.ApiGateway(restApi)),
      zone: hostedZone
    }
  );
  return restApi;



  const domainName = `api.sharedservice.${guardianDetails.hostedZoneName}`.replace(/\//g, '');

  // This will create the custom api gateway based on the domain name.
  const restApi = createCustomApiGateway(guardianDetails, stack, environmentProps, domainName, 'shared-service');

  const sessionAuthorizerPropsDetails: any = {
    namespace: stage,
    isProduction: environmentProps.accountEnvProps.isProduction,
    productName: Constants.SessionTableProductName,
    region: environmentProps.accountEnvProps.env.region,
    account: environmentProps.accountEnvProps.env.account,
    cookieName: Constants.sessionToken
  };

  // New function which creates authorizer for us.
  const sessionAuthorizerDetail = createSessionAuthorizer(stack, sessionAuthorizerPropsDetails);

  // Attach the authorizer which is created in portal gateway
  /* eslint-disable camelcase */
  const authorizer = new apiGateway.RequestAuthorizer(
    stack,
    `${environmentProps.environmentName}-bffpk-authorizer-api`,
    {
      handler: sessionAuthorizerDetail.lambdaApiAuthorizer as unknown as IFunction,
      /* eslint-disable camelcase */
      identitySources: sessionAuthorizerDetail.identitySources,
      
      resultsCacheTtl: Duration.seconds(0) // Disable cache on authorizer
    }
  );

  // lambda function
  const featureFlagFunction = new CustomNodejsFunction(
    stack,
    `${environmentProps.environmentName}-lambda-feature-flag-function`,
    {
      entry: path.join(__dirname, '../../../../functions/api/sharedservices/featureflag/src/feature-flag-handler.ts'),
      architecture: Architecture.ARM_64,
      timeout: Duration.seconds(30),
      runtime: Runtime.NODEJS_18_X,
      memorySize: lambdaMemoryValue,
      ephemeralStorageSize: Size.mebibytes(lambdaEphemeralStorageValue),
      role,
      handler: 'featureflag',
      environment: { ...environment, FUNCTION_NAME: 'feature-flag-handler' }
    },
    props.envProps
  );

  // Grant decrypt permission to the lambda function
  props.launchDarklyKmsKey.grantDecrypt(featureFlagFunction);

  // Add an integration with the Lambda function
  const featureFlagResource = restApi.root.addResource('featureflag');

  // Add method along with integration lambda with api gateway
  featureFlagResource.addMethod('POST', new apiGateway.LambdaIntegration(featureFlagFunction), {
    authorizer,
    authorizationType: AuthorizationType.CUSTOM
  });

Note - createSessionAuthorizer is coming from separate package.

Error: Resolution error: Resolution error: Resolution error: Authorizer
must be attached to a RestApi.
Object creation stack:
at Execute again with CDK_DEBUG=true to capture stack traces..

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.118.0

Framework Version

No response

Node.js Version

18

OS

windows

Language

TypeScript

Language Version

No response

Other information

No response

[typefox09]

Having this same issue.

[ashishdhingra]

@awsrookie18 Good afternoon. Please share the following:

• Why are you creating a separate RequestAuthorizer from your customSessionAuthorizer()? Does customSessionAuthorizer() returns an authorizer which is somehow not associated with RestApi?
  • Most likely the error is thrown at lazyRestApiId when Rest API Id is not associated with authorizer.
• Could you please share the complete stack trace of the failure?

Found useful article API Gateway Lambda Custom Authorizer with AWS CDK for reference.

Thanks,
Ashish

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[bramski]

Arrived here from search for this error as I'm encountering asimilar issue. Was there a resolution?

[aws-cdk-automation]

Comments on closed issues and PRs are hard for our team to see. If you need help, please open a new issue that references this one.