Feature request: Allow explicit DefaultAuthorizer: None on AWS::Serverless::Api

[ethanmills]

Describe your idea/feature/enhancement

It would be great if SAM could accept an explicit None in the DefaultAuthorizer when there are authorizers configured. This would be useful when I only want to set authorizers in certain environments.

Proposal

I'm not sure of the exact syntax that would be needed to not make this a breaking change, perhaps a blank string?

[moelasmar]

thanks @ethanmills for raising this request.

[ethanmills]

Thinking about it, this might belong in https://github.com/aws/serverless-application-model?

[moelasmar]

sorry I missed the issue title, yes this should belongs to the SAM Translator repo. I will move it there.

[ethanmills]

If it's likely to be accepted I'd be interested in writing a PR for this

[aaythapa]

Hi @ethanmills, we still accept external PRs so we'd be happy to review and merge. Please follow our development guidelines when making the code change. Thanks!

[awood45]

Moving to discussions where we track feature requests, but I agree we would take a PR on this. The discussion could also be used to consider how to represent the "None" authorizer.

[awood45]

One problem you might run into is that we use the Authorizer name as a way to look up an Authorizer we have defined. We need to be careful that we don't create a breaking change here.

It might be worth creating a sort of "Dummy Authorizer" so that you're explicitly defining and referencing a named "none" authorizer.

[ethanmills]

Would this be a good place to use AWS::NoValue ?

[ethanmills]

I've not had much time to spend on this today, but I've started an implementation of this here. Happy to be told it's a terrible idea, but otherwise I'll plug away at it when I have time and get a PR up

[GavinZZ]

Hi @ethanmills, thanks for the contribution. It generally looks on the right paths with some comments. Feel free to create a PR and we can continue the discussion there.

[ethanmills]

Cheers, I've opened #3321 as draft. Comments welcome

[GavinZZ]

Hi @ethanmills, thanks for raising this feature request. Just a thought, have you tried out using DefaultAuthorizer: null?

I had a quick test and it seems to work for me. Here is my sample template:

Resources:
  HttpApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3://sam-demo-bucket/todo_list.zip
      Handler: index.restapi
      Runtime: python3.7
      Events:
        DefaultAuth:
          Type: HttpApi
          Properties:
            Path: /default
            Method: post
            ApiId: !Ref MyApi
        SpecifiedAuth:
          Type: HttpApi
          Properties:
            Path: /specified
            Method: get
            ApiId: !Ref MyApi
            Auth:
              Authorizer: LambdaAuth
  MyAuthFn:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3://bucket/key
      Handler: index.handler
      Runtime: nodejs12.x

  MyApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Tags:
        Tag1: value1
        Tag2: value2
      Auth:
        Authorizers:
          LambdaAuth:
            FunctionArn: !GetAtt MyAuthFn.Arn
            AuthorizerPayloadFormatVersion: 1.0
        DefaultAuthorizer: null

The transformed template shows the following section where /specified shows the authorizer since we explicitly set authorizer in Lambda event source while /default doesn't have anything related to authorizer.

"paths": {
      "/specified": {
       "get": {
        "x-amazon-apigateway-integration": {
         "httpMethod": "POST",
         "type": "aws_proxy",
         "uri": {
          "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${HttpApiFunction.Arn}/invocations"
         },
         "payloadFormatVersion": "2.0"
        },
        "security": [
         {
          "LambdaAuth": []
         }
        ],
        "responses": {}
       }
      },
      "/default": {
       "post": {
        "x-amazon-apigateway-integration": {
         "httpMethod": "POST",
         "type": "aws_proxy",
         "uri": {
          "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${HttpApiFunction.Arn}/invocations"
         },
         "payloadFormatVersion": "2.0"
        },
        "responses": {}
       }
      }
     },