Package: aws-cdk-secure-api
aws-cdk-secure-apiAn unofficialAWS CDK v2Construct Library for Secure REST APIs.Documentation:https://aws-cdk-secure-api.readthedocs.io.Installpip install aws-cdk-secure-apiConstructsSecureRestApi- A construct to create a (public) REST API secured behind an API key, which needs to be
specified in thex-api-keyheader for all requests.IAMSecureRestApi- A construct to create a (public) REST API secured behindAWS IAM authentication, which
requires IAM credentialsto be signedand included in all requests.FeaturesA CDK Construct which sets up aRestApisecured behind (one of):API keyAn API key isauto-generatedand stored in SSM Parameter Store (which is
a free service) as needed.Local cache for the API key, so that API calls are not needed in future
CDK deployments.AWS IAM authenticationAn IAM User (and Policy/Role) is created with minimal permissions to call / invoke the API.The IAM User Credentials (Access Keys) are stored in AWS Secrets Manager.Helper methods for all constructs, such asadd_resource_and_lambda_methods, to make it easier to
integrate a method for an AWS Lambda function for example.UsageTheSecureRestApiconstruct represents a Secure REST API in Amazon API Gateway.Useadd_resource,add_lambda_methods, andadd_methodsto
configure the API model, as shown below.Using a root resource:fromaws_cdk.aws_apigatewayimportStageOptionsfromaws_cdk.aws_lambdaimportFunction,Runtimefromaws_cdk_secure_apiimportHttp,SecureRestApi# noinspection PyTypeCheckerpy_runtime:Runtime=Runtime.PYTHON_3_10get_handler=Function(self,'lambda1',runtime=py_runtime,...)put_handler=Function(self,'lambda2',runtime=py_runtime,...)api=SecureRestApi(self,'api',rest_api_name='My Secure Service',# optional: specify a deployment stagedeploy_options=StageOptions(stage_name='dev'))api.add_lambda_methods(get_handler,'GET')# GET /api.add_lambda_methods(put_handler,Http.PUT,Http.POST)# PUT /, POST /Using a custom-named resource:Replace above usage ofadd_lambda_methodswithadd_resource_and_lambda_methods, as shown below.# GET /path1api.add_resource_and_lambda_methods(get_handler,'/path1','GET')# PUT /path2, POST /path2api.add_resource_and_lambda_methods(put_handler,'/path2',Http.PUT,Http.POST)TheIAMSecureRestApiconstruct represents a Secure REST API in Amazon API Gateway,
which requires IAM Authorization.Using a custom-named resource:fromaws_cdk.aws_apigatewayimportStageOptionsfromaws_cdk.aws_lambdaimportFunction,Runtimefromaws_cdk_secure_apiimportHttp,IAMConfig,IAMSecureRestApi# noinspection PyTypeCheckerpy_runtime:Runtime=Runtime.PYTHON_3_10get_handler=Function(self,'lambda1',runtime=py_runtime,...)put_handler=Function(self,'lambda2',runtime=py_runtime,...)api=IAMSecureRestApi(self,'api',rest_api_name='My IAM Secure Service',# optional: specify the name of secret to store IAM User Credentialsconfig=IAMConfig(secret_name='my-stack/iam-user-access-keys'),# optional: specify a deployment stagedeploy_options=StageOptions(stage_name='dev'))# GET /path1api.add_resource_and_lambda_methods(get_handler,'/path1','GET')# PUT /path2, POST /path2api.add_resource_and_lambda_methods(put_handler,'/path2',Http.PUT,Http.POST)To use an IAM Role instead of attaching a Policy directly to User:IAMConfig(use_role=True)AWS ProfileNote that if you normally pass the--profileto thecdktool, for example such as:cdk deploy --profile my-aws-profileThe CDK construct won’t be able to detect the AWS profile in this particular case.
A few workarounds can be used for this:The environment variableAWS_PROFILEcan be set before calling thecdktool.Theprofileattribute can be passed in to theconfigparameter forSecureRestApi.Theprofilecontext variable can be passed in to thecdktool,
as shown below:cdk deploy --profile my-profile -c profile=my-profileAPI KeysHere is the process that the CDK construct uses for generating
or using an API key for a REST API.First, it tries to read the API key from local cache, which is located in your
home directory, under~/.cdk/cache/apigw_api_keys.json.If an API key is found, then it proceeds to use the cached key value, anddoes notperform the following steps.An API call is made to read the key from AWS SSM Parameter Store. The param
name is/{STACKNAME}/api-key, where{STACK NAME}is the name of the CDK stack.If the parameter does not exist, an random API key value is auto-generated, and a new
SSM Parameter is created in the same AWS account and region that the CDK stack is deployed to.The API key value is then cached on the local drive, under the~/.cdk/cachefolder.Stack OutputsThe followingstack outputswill additionally be added to the CDK stack:APIEndpoint- The base endpoint of the Secure REST API.Note:this output will not show up ifoverride_endpoint_nameis disabled
in theconfigparameter.APIKey- The API key for the endpoint, which needs to be specified
as a value in an HTTP request’sx-api-keyheader.APIIAMUserCredentials- The URL link (to input in a browser) for the Secret
stored in AWS Secrets Manager containing the AWS IAM Credentials for invoking the REST API.APIIAMRoleARN- The ARN of the IAM Role, used in anAssumeRoleAPI call with the IAM User credentials.CreditsThis package was created withCookiecutterand thernag/cookiecutter-pypackageproject template.History0.5.0 (2023-06-23)Features and ImprovementsAdd optionuse_roleinIAMConfig, which when enabled will set up
an IAM Role (with permissions to invoke the API) to be assumed by the IAM User,
instead of directly attaching an IAM Policy to said User.0.4.0 (2023-06-22)Features and ImprovementsAdd IAM Authentication via the newIAMSecureRestApiconstruct.0.3.0 (2023-05-17)Features and ImprovementsAdd a helper methodadd_resource_and_lambda_methods, to set up a new
API resource, a lambda integration, and setup HTTP method(s) on the
new resource at the same time.Update other helper methods – such asadd_lambda_methods– to accept
an optionalresourceparameter, which defaults to the “root” API
resource (/) by default.Addtestparameter (boolean) toSecureRestApi– if enabled,
then a live API call to AWS SSM (Parameter Store)
won’t be performed on an initial run, and instead a dummy API key value
is used.0.2.0 (2023-05-17)BugfixesMake code compatible withPython 3.11.Features and ImprovementsAdd3.11to the list of supported Python versions.0.1.1 (2022-06-24)BugfixesRemovetyping.Literalusage, so code is compatible with Python 3.7Add an importfrom __future__ import annotationsto modules where it was missing.Features and ImprovementsUpdate to use the string value of thenameattribute for aHttpEnum member,
instead of thevalueattribute.0.1.0 (2022-06-24)First release on PyPI.