resourcePolicy not applying to deployed lambda function

[chris-hinds]

I am trying to apply a resourcePolicy to my custom authoriser lambda, so that my HTTP API can invoke the authoriser lambda.

This is my provider setup for the lambda;

provider:
  name: aws
  region: ${file(../commonServerlessConfig.yml):region}
  stackName: XXXX-api-authoriser
  runtime: ${file(../commonServerlessConfig.yml):runtime}
  memorySize: ${file(../commonServerlessConfig.yml):memorySize}
  timeout: ${file(../commonServerlessConfig.yml):timeout}
  versionFunctions: ${file(../commonServerlessConfig.yml):versionFunctions}
  httpApi: ${file(../commonServerlessConfig.yml):httpApi}
  resourcePolicy:
    - Effect: Allow
      Action: lambda:InvokeFunction
      Principal:
        Service: apigateway.amazonaws.com
      Resource:
        - arn:aws:lambda:eu-west-1:XXXXXXX:function:apiAuthoriser
      Condition:
        ArnLike:
          AWS:SourceArn: arn:aws:execute-api:eu-west-1:XXXXXX:XXXXXX/authorizers/XXXX

When the lambda is deployed there is no attached resourcePolicy. The serverless generated cloud formation includes the resource policy;

"versionFunctions": false,
      "httpApi": {
        "id": {
          "Fn::ImportValue": "XXXXHTTPApiGW-HTTPApiId"
        }
      },
      "resourcePolicy": [
        {
          "Effect": "Allow",
          "Action": [
            "lambda:InvokeFunction"
          ],
          "Principal": {
            "Service": [
              "apigateway.amazonaws.com"
            ]
          },
          "Resource": "arn:aws:lambda:eu-west-1:XXXXX:function:apiAuthoriser",
          "Condition": {
            "ArnLike": {
              "AWS:SourceArn": "arn:aws:execute-api:eu-west-1:XXXXXX:XXXXXX/authorizers/XXXX"
            }
          }
        }
      ],
      "stage": "dev",

[pgrzesik]

Hello @chris-hinds 👋 Could you please share a little bit more information about your config? Maybe a small reproducible example? What is shown in the second snippet? It doesn't look like the compiled CloudFormation template.

Btw - resourcePolicy is applied only for apiGateway/http event type, it does not work for httpApi events

[chris-hinds]

Oops, I shared the serverless-state.json snippet 🤦‍♂️ I am adding this policy in the wrong place then? This authoriser lambda is in its own stack, the http API Gateway and authoriser are in another stack.

[chris-hinds]

If I go to the console, and edit this lambda I can manually add a resource policy allowing my api gateway to invoke this lambda, and then everything works as expected.

[chris-hinds]

tldr of my stack setup.

Stack A:

• Api gateway
• Api gateway custom authoriser with REQUEST type

Stack B:

• Authroiser Lambda
• This is where I am trying to include a resource policy to allow API GW to invoke this lambda

Stack C:

• Lambda API functions with httpApi events, using shared API GW from Stack A

[pgrzesik]

How are you referencing that Authorizer Lambda in Stack A? When configuring the authorizer, proper AWS::Lambda:Permission should be created to allow invocation of authorizer from API GW.

[pgrzesik]

Oh, okay, if you're creating the authorizer the "hard way" with raw CloudFormation then you have to create all accompanying resources yourself. If you'd use the native support for authorizers it would be created automatically for you. Docs reference: https://www.serverless.com/framework/docs/providers/aws/events/http-api/#lambda-request-authorizers

[chris-hinds]

When you say "native support" what do you mean exactly?

[pgrzesik]

By native support I've meant the support for HTTP API authorizers via sls-specific syntax, which would create all needed raw CF resources behind the scenes. You can refer to the doc that I've linked for an example on how to do that.

[chris-hinds]

I followed this section when creating my authoriser https://www.serverless.com/framework/docs/providers/aws/events/http-api/#shared-authorizer

The authorisers attach the each lambda function ok, it just seems that API GW cannot invoke the authoriser

[chris-hinds]

By native support I've meant the support for HTTP API authorizers via sls-specific syntax, which would create all needed raw CF resources behind the scenes. You can refer to the doc that I've linked for an example on how to do that.

I see, I didn't think I could do that as as I wanted to have a single Authroiser and a single API GW shared across multiple stacks

[chris-hinds]

I have sorted the issue now. Previously I was trying to attach the IAM role to the lambda authoriser itself.

Instead, the role/policy to invoke the lambdas should actually be attached to the API GW authoriser like below;

PhoenixHTTPApiGWAuthorizer:
      Type: "AWS::ApiGatewayV2::Authorizer"
      Properties:
        Name: XXXXXHTTPApiGWAuthorizer
        AuthorizerCredentialsArn:
          Fn::GetAtt:
            - XXXXXHTTPApiGWAuthorizerRole
            - Arn
        ApiId: !Ref XXXXXHTTPApiGW
        AuthorizerType: REQUEST
        AuthorizerPayloadFormatVersion: "2.0"
        EnableSimpleResponses: true
        AuthorizerResultTtlInSeconds: 0
        AuthorizerUri:
          Fn::Sub:
            - "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${AuthoriserLambdaArn}/invocations"
            - AuthoriserLambdaArn:
                Fn::ImportValue: XXXXXHTTPApiGW-HTTPApiAuthoriserArn
        IdentitySource:
          - $request.header.Authorization

    XXXXXHTTPApiGWAuthorizerRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Principal:
                Service:
                  - "apigateway.amazonaws.com"
              Action:
                - sts:AssumeRole
        Policies:
          - PolicyName: "XXXXXInvokeAuthoriserFunction"
            PolicyDocument:
              Version: "2012-10-17"
              Statement:
                - Effect: "Allow"
                  Action:
                    - lambda:InvokeAsync
                    - lambda:InvokeFunction
                  Resource: !ImportValue XXXXXHTTPApiGW-HTTPApiAuthoriserArn

[chris-hinds]

Thanks for the assistance @pgrzesik

[pgrzesik]

Happy to hear you've figured it out 🙌