feat(aws-apigatewayv2): add support for api-key in websocket apis

aws · Sep 28, 2021 · b45ca7f · b45ca7f
1 parent d21561a
commit b45ca7f
Show file tree

Hide file tree

Showing 6 changed files with 115 additions and 1 deletion.
diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/websocket/api.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/websocket/api.ts
@@ -16,16 +16,37 @@ export interface IWebSocketApi extends IApi {
   _addIntegration(scope: Construct, config: WebSocketRouteIntegrationConfig): WebSocketIntegration
 }
 
+/**
+ * Represents the currently available API Key Selection Expressions
+ */
+export enum ApiKeySelectionExpression {
+  /**
+ * x-api-key type
+ */
+  X_API_KEY = '$request.header.x-api-key',
+
+  /**
+ * usageIdentifierKey type
+ */
+  USAGE_IDENTIFIER_KEY = '$context.authorizer.usageIdentifierKey'
+}
+
 /**
  * Props for WebSocket API
  */
 export interface WebSocketApiProps {
   /**
-   * Name for the WebSocket API resoruce
+   * Name for the WebSocket API resource
    * @default - id of the WebSocketApi construct.
    */
   readonly apiName?: string;
 
+  /**
+   * An API key selection expression. Currently only supports '$request.header.x-api-key' and '$context.authorizer.usageIdentifierKey'
+   * @default - $request.header.x-api-key
+   */
+  readonly apiKeySelectionExpression?: ApiKeySelectionExpression
+
   /**
    * The description of the API.
    * @default - none
@@ -80,6 +101,7 @@ export class WebSocketApi extends ApiBase implements IWebSocketApi {
 
     const resource = new CfnApi(this, 'Resource', {
       name: this.webSocketApiName,
+      apiKeySelectionExpression: props?.apiKeySelectionExpression ?? ApiKeySelectionExpression.X_API_KEY,
       protocolType: 'WEBSOCKET',
       description: props?.description,
       routeSelectionExpression: props?.routeSelectionExpression ?? '$request.body.action',

diff --git a/packages/@aws-cdk/aws-apigatewayv2/lib/websocket/route.ts b/packages/@aws-cdk/aws-apigatewayv2/lib/websocket/route.ts
@@ -45,6 +45,12 @@ export interface WebSocketRouteProps extends WebSocketRouteOptions {
    * The key to this route.
    */
   readonly routeKey: string;
+
+  /**
+   * Whether the route requires an API Key to be provided
+   * @default - false
+   */
+  readonly apiKeyRequired?: boolean;
 }
 
 /**
@@ -76,6 +82,7 @@ export class WebSocketRoute extends Resource implements IWebSocketRoute {
 
     const route = new CfnRoute(this, 'Resource', {
       apiId: props.webSocketApi.apiId,
+      apiKeyRequired: props.apiKeyRequired,
       routeKey: props.routeKey,
       target: `integrations/${integration.integrationId}`,
     });

diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/websocket/api.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/websocket/api.test.ts
@@ -1,6 +1,7 @@
 import { Template } from '@aws-cdk/assertions';
 import { Stack } from '@aws-cdk/core';
 import {
+  ApiKeySelectionExpression,
   IWebSocketRouteIntegration, WebSocketApi, WebSocketIntegrationType,
   WebSocketRouteIntegrationBindOptions, WebSocketRouteIntegrationConfig,
 } from '../../lib';
@@ -15,6 +16,28 @@ describe('WebSocketApi', () => {
 
     // THEN
     Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Api', {
+      ApiKeySelectionExpression: '$request.header.x-api-key',
+      Name: 'api',
+      ProtocolType: 'WEBSOCKET',
+    });
+
+    Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Stage', 0);
+    Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Route', 0);
+    Template.fromStack(stack).resourceCountIs('AWS::ApiGatewayV2::Integration', 0);
+  });
+
+  test('apiKeySelectionExpression: given $context.authorizer.usageIdentifierKey', () => {
+    // GIVEN
+    const stack = new Stack();
+
+    // WHEN
+    new WebSocketApi(stack, 'api', {
+      apiKeySelectionExpression: ApiKeySelectionExpression.USAGE_IDENTIFIER_KEY,
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Api', {
+      ApiKeySelectionExpression: '$context.authorizer.usageIdentifierKey',
       Name: 'api',
       ProtocolType: 'WEBSOCKET',
     });

diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/websocket/integ.api-default.expected.json b/packages/@aws-cdk/aws-apigatewayv2/test/websocket/integ.api-default.expected.json
@@ -0,0 +1,13 @@
+{
+  "Resources": {
+    "MyWebsocketApiEBAC53DF": {
+      "Type": "AWS::ApiGatewayV2::Api",
+      "Properties": {
+        "ApiKeySelectionExpression": "$request.header.x-api-key",
+        "Name": "MyWebsocketApi",
+        "ProtocolType": "WEBSOCKET",
+        "RouteSelectionExpression": "$request.body.action"
+      }
+    }
+  }
+}
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/websocket/integ.api-default.ts b/packages/@aws-cdk/aws-apigatewayv2/test/websocket/integ.api-default.ts
@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import * as cdk from '@aws-cdk/core';
+import * as apigw from '../../lib';
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'aws-cdk-aws-apigatewayv2-websockets');
+
+new apigw.WebSocketApi(stack, 'MyWebsocketApi');
+
+app.synth();
diff --git a/packages/@aws-cdk/aws-apigatewayv2/test/websocket/route.test.ts b/packages/@aws-cdk/aws-apigatewayv2/test/websocket/route.test.ts
@@ -41,6 +41,44 @@ describe('WebSocketRoute', () => {
       IntegrationUri: 'some-uri',
     });
   });
+
+  test('Api Key is required for route when apiKeyIsRequired is true', () => {
+    // GIVEN
+    const stack = new Stack();
+    const webSocketApi = new WebSocketApi(stack, 'Api');
+
+    // WHEN
+    new WebSocketRoute(stack, 'Route', {
+      webSocketApi,
+      integration: new DummyIntegration(),
+      routeKey: 'message',
+      apiKeyRequired: true,
+    });
+
+    // THEN
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Route', {
+      ApiId: stack.resolve(webSocketApi.apiId),
+      ApiKeyRequired: true,
+      RouteKey: 'message',
+      Target: {
+        'Fn::Join': [
+          '',
+          [
+            'integrations/',
+            {
+              Ref: 'RouteWebSocketIntegrationb7742333c7ab20d7b2b178df59bb17f20338431E',
+            },
+          ],
+        ],
+      },
+    });
+
+    Template.fromStack(stack).hasResourceProperties('AWS::ApiGatewayV2::Integration', {
+      ApiId: stack.resolve(webSocketApi.apiId),
+      IntegrationType: 'AWS_PROXY',
+      IntegrationUri: 'some-uri',
+    });
+  });
 });