Repository: serverless/serverless (JavaScript)
Date: 2020-01-14 10:58:11+00:00
Task type: Bug Fix

Issue:
After upgrading to 1.60.5, Api method property "Invoke with caller credentials" cannot be set anymore
# Bug Report

## Description

1. What did you do?

`npx serverless deploy --id test`

1. What happened?

The default generated "resourcePolicy" for ApiGateway is conflicting with the method option "Invoke with caller credentials".

* **cloudFormation error :**

`Caller provided credentials not allowed when resource policy is set (Service: AmazonApiGateway; Status Code: 400; Error Code: BadRequestException`

1. What should've happened?
Deployment should be successful and the API method property "Invoke with caller credentials" should be activated

1. What's the content of your `serverless.yml` file?

```
service: 
  name: serverless-tester-${self:custom.service}

provider:
  name: aws
  runtime: nodejs12.x
  stage:  ${file(./config.${self:custom.id}.json):stage}
  region:  ${file(./config.${self:custom.id}.json):region}
  endpointType: regional
  logRetentionInDays: 30
  versionFunctions: false

  deploymentBucket:
    name: ${file(./config.${self:custom.id}.json):deploymentBucketName}

package:
  excludeDevDependencies: true

functions:
  internalApiTester:
    handler: src/genericLambda.handler
    timeout: 30
    memorySize: 256
    vpc: ${file(./config.${self:custom.id}.json):vpc}
    events:
      - http:
          path: /generic/tester
          method: GET
          authorizer: aws_iam
resources:
  Resources:
    ApiGatewayMethodGenericTesterGet:
      Type: AWS::ApiGateway::Method
      Properties:
        Integration:
          Credentials: "arn:aws:iam::*:user/*"
plugins:
  - serverless-pseudo-parameters
custom:
  id: ${opt:id}
  service: ${file(./config.${self:custom.id}.json):service}
```


This issue seems to be related to the pull request

- #7138



Issue discussion:
Thanks @ftmazzone for report. Can you update the test case, so it doesn't involve any plugins?

(if the issue is influenced by a plugin, the bug report should be reported at plugin repository)
In substitution for Florent, here is the example:
----------------------------------------------------------

```
service:

  name: serverless-tester

provider:

  name: aws

  runtime: nodejs12.x

  stage:  dev
  region:  us-east-1
  endpointType: regional
  logRetentionInDays: 30
  versionFunctions: false

package:

  excludeDevDependencies: true

functions:

  internalApiTester:
    handler: src/genericLambda.handler
    timeout: 30

    memorySize: 256

    events:
      - http:
          path: /generic/tester
          method: GET
          authorizer: aws_iam

resources:
  Resources:
    ApiGatewayMethodGenericTesterGet:
      Type: AWS::ApiGateway::Method
      Properties:
        Integration:
          Credentials: "arn:aws:iam::*:user/*"
```

Thank you @carstenmuellerlemberg I can reproduce it now.

I'm in contact with AWS support team, on whether we can address it without a need of reopenning of https://github.com/serverless/serverless/issues/6789 

Anyway it should be fixed shortly
Thank you @medikoo for the quick update. To date I did not find any AWS documentation about this limitation.

Solution patch:
diff --git a/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.js b/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.js
index fa0f3715bb4..c30c99c535f 100644
--- a/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.js
+++ b/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.js
@@ -3,23 +3,6 @@
 const _ = require('lodash');
 const BbPromise = require('bluebird');
 
-const defaultPolicy = {
-  Version: '2012-10-17',
-  Statement: [
-    {
-      Effect: 'Allow',
-      Principal: '*',
-      Action: 'execute-api:Invoke',
-      Resource: ['execute-api:/*/*/*'],
-      Condition: {
-        IpAddress: {
-          'aws:SourceIp': ['0.0.0.0/0', '::/0'],
-        },
-      },
-    },
-  ],
-};
-
 module.exports = {
   compileRestApi() {
     const apiGateway = this.serverless.service.provider.apiGateway || {};
@@ -87,9 +70,7 @@ module.exports = {
         this.serverless.service.provider.compiledCloudFormationTemplate.Resources[
           this.apiGatewayRestApiLogicalId
         ].Properties,
-        {
-          Policy: defaultPolicy,
-        }
+        { Policy: '' }
       );
     }
 


Test patch:
diff --git a/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.test.js b/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.test.js
index 142ed7cc149..73ffbe6872f 100644
--- a/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.test.js
+++ b/lib/plugins/aws/package/compile/events/apiGateway/lib/restApi.test.js
@@ -49,22 +49,7 @@ describe('#compileRestApi()', () => {
           EndpointConfiguration: {
             Types: ['EDGE'],
           },
-          Policy: {
-            Statement: [
-              {
-                Action: 'execute-api:Invoke',
-                Condition: {
-                  IpAddress: {
-                    'aws:SourceIp': ['0.0.0.0/0', '::/0'],
-                  },
-                },
-                Effect: 'Allow',
-                Principal: '*',
-                Resource: ['execute-api:/*/*/*'],
-              },
-            ],
-            Version: '2012-10-17',
-          },
+          Policy: '',
         },
       });
     }));
@@ -129,22 +114,7 @@ describe('#compileRestApi()', () => {
           EndpointConfiguration: {
             Types: ['EDGE'],
           },
-          Policy: {
-            Version: '2012-10-17',
-            Statement: [
-              {
-                Effect: 'Allow',
-                Principal: '*',
-                Action: 'execute-api:Invoke',
-                Resource: ['execute-api:/*/*/*'],
-                Condition: {
-                  IpAddress: {
-                    'aws:SourceIp': ['0.0.0.0/0', '::/0'],
-                  },
-                },
-              },
-            ],
-          },
+          Policy: '',
         },
       });
     });
@@ -178,22 +148,7 @@ describe('#compileRestApi()', () => {
             Types: ['EDGE'],
           },
           Name: 'dev-new-service',
-          Policy: {
-            Statement: [
-              {
-                Action: 'execute-api:Invoke',
-                Condition: {
-                  IpAddress: {
-                    'aws:SourceIp': ['0.0.0.0/0', '::/0'],
-                  },
-                },
-                Effect: 'Allow',
-                Principal: '*',
-                Resource: ['execute-api:/*/*/*'],
-              },
-            ],
-            Version: '2012-10-17',
-          },
+          Policy: '',
         },
       });
     });