(aws-apigatewayv2-authorizers): Expose Authorizer ID to make it reusable from other projects

[JonWallsten]

Describe the feature

I need to be able to retrieve the Authorizer ID (the generated ID, not the one passed to the Construct) from the L2 construct.
Looking through the code I guess the issue is that the authorizer is not created until it's attached to a route. So I cannot personally create a PR for this since I don't know how references are resolved when the templates are generated.

Use Case

I want to be able to reuse the authorizer in other projects in the same account.

Proposed Solution

Expose the id the same way other constructs are.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.159.0

Environment details (OS name and version, etc.)

Windows 11 23H2

[pahud]

Makes sense to me.

I think we can consider exposing the authorizer from here:

aws-cdk/packages/aws-cdk-lib/aws-apigatewayv2-authorizers/lib/http/lambda.ts

Line 93 in 4128bf1

this.authorizer = new HttpAuthorizer(options.scope, this.id, {

which is currently a private attribute

aws-cdk/packages/aws-cdk-lib/aws-apigatewayv2-authorizers/lib/http/lambda.ts

Line 68 in 4128bf1

private authorizer?: HttpAuthorizer;

We welcome PRs and please help us prioritize with 👍

[pahud]

related to: V1533536242

[JonWallsten]

@pahud I tried to access that variable, but it is undefined when you setup the autherizer. It's not until you attach it to the first HttpRoute that you actually get the token. But I guess that's "as designed", it might not be clear to everyone though. My workaround for now is to access the private HttpRoute.authBindResult for the first HttpRoute I assigned it to. But I guess I could also access it through the Authorizer AFTER the first binding. But it still feels a bit weird to have to do it after it's first usage and not after the construction.

[JonWallsten]

I can try to create a pr but I will need some guidance! I'll tag you in the PR when it's done.
Would you prefer to expose the entire authorizer or add a getter for exposing only the authorizerId on its own ?
The authorizerType also has to be exposed since it's needed to "lookup" the authorizer layer on.

[pahud]

@JonWallsten

At this moment, I guess you'll need the trick like this

export class HttplambdaStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Define the Lambda function for the authorizer
    const authorizerFunction = new lambda.Function(this, 'AuthorizerFunction', {
      runtime: lambda.Runtime.NODEJS_18_X,
      handler: 'authorizer.handler',
      code: lambda.Code.fromInline('dummy'),
    });

    // Define the Lambda function for the API endpoint
    const apiFunction = new lambda.Function(this, 'ApiFunction', {
      runtime: lambda.Runtime.NODEJS_LATEST,
      handler: 'api.handler',
      code: lambda.Code.fromInline('dummy'),
    });

    // Define the HTTP API
    const httpApi = new apigatewayv2.HttpApi(this, 'HttpApi', {
      apiName: 'MyHttpApi',
    });

    // Define the Lambda authorizer
    const httpLambdaAuthorizer = new authorizers.HttpLambdaAuthorizer('LambdaAuthorizer', authorizerFunction, {
      responseTypes: [authorizers.HttpLambdaResponseType.SIMPLE],
    });
    
    // Add a route with the Lambda authorizer
    httpApi.addRoutes({
      path: '/my-endpoint',
      methods: [apigatewayv2.HttpMethod.GET],
      integration: new integrations.HttpLambdaIntegration('ApiIntegration', apiFunction),
      authorizer: httpLambdaAuthorizer,
    });

    const cfnauthorizer = httpApi.node.tryFindChild('LambdaAuthorizer')?.node.defaultChild as apigatewayv2.CfnAuthorizer

    new cdk.CfnOutput(this, 'LambdaAuthorizerId', {
      value: cfnauthorizer.ref,
      description: 'The ID of the authorizer',
    });
  }
}

Let me know if it works for you.

[JonWallsten]

@pahud :
You should also be able to to this:

const authorizer = /* your authorizer code here*/;
const httpRoute = new HttpRoute(this, `HttpRoute`, {
    httpApi: props.httpApi,
    integration: props.integration,
    authorizer: authorizer,
    routeKey: HttpRouteKey.with(props.route, props.method)
});

const id = httpRoute['authBindResult'].authorizerId;
// or
const id = authorizer['authorizer'].authorizerId;

[pahud]

@JonWallsten Agree. That's why I mentioned we need to make this public before we are allowed to do that and before that what I was offering could be a temporary workaround.

That being said, there may be other concerns I haven't considered yet.

aws-cdk/packages/aws-cdk-lib/aws-apigatewayv2-authorizers/lib/http/lambda.ts

Line 68 in 4128bf1

private authorizer?: HttpAuthorizer;

Feel free to submit a PR whenever you're ready, and we can move forward from there.

Thank you.