AWS SAM + Cloudformation macros, a patch made in heaven
Tags: aws, lambda, programming, serverless
Published: 2019-05-17 01:47:15

---
title: AWS SAM + Cloudformation macros, a patch made in heaven
published: true
tags: AWS,Lambda,Programming,Serverless
canonical_url: https://theburningmonk.com/2019/05/aws-sam-cloudformation-macros-a-patch-made-in-heaven/
---

Over the last few weeks I have been working with a very ambitious client—[Solve](https://solvehq.com/), who is building a new murder mystery game. They are doing some really cool things technically, and are building an entirely serverless stack.

While working with Solve I have spent a lot of time with [AWS SAM](https://github.com/awslabs/serverless-application-model). That experience also helped inform my opinion about SAM, as I explained in this [article](https://lumigo.io/blog/comparison-of-lambda-deployment-frameworks/). Where compared with the [Serverless framework](http://serverless.com/framework/) it’s lacking the customizability that the serverless offers through its plugin system.

![](https://theburningmonk.com/wp-content/uploads/2019/05/img_5cddfd8fe678a.png)

With the Serverless framework, I can write plugins to tailor the framework’s built-in behaviours. This gets me out of jail whenever I disagree with the framework’s choices. However, I don’t have such a luxury with SAM.

Just today, I ran into a problem with SAM’s [support for AWS\_IAM](https://aws.amazon.com/about-aws/whats-new/2019/aws_serverless_application_Model_support_IAM/) authorizer in API Gateway. The built-in behaviour is such that, anytime I choose to use AWS\_IAM as the authorizer it’ll default the `InvokeRole` to `CALLER_CREDENTIALS`. Even if I explicitly set `InvokeRole` to `null`.

![](https://theburningmonk.com/wp-content/uploads/2019/05/img_5cddfdea139aa.png)

![](https://theburningmonk.com/wp-content/uploads/2019/05/img_5cddfdf7c717f.png)

This means the caller’s IAM role would be used to invoke the Lambda function. So, to call my IAM-protected endpoint, I need to sign the request with an IAM profile with the permissions to:

- [execute-api:Invoke](https://iam.cloudonaut.io/reference/execute-api.html) against the API Gateway resource
- **and** [lambda:InvokeFunction](https://iam.cloudonaut.io/reference/lambda.html) against the Lambda function sitting behind API Gateway

That completely breaks the abstraction layer! As a caller, I not only need to know the endpoint I wish to talk to, but also how it’s implemented under the hood. If the API maintainer renames the functions behind the endpoint, my code would suddenly break.

If this issue also impacts you, then keep an eye on [this Github issue](https://github.com/awslabs/serverless-application-model/issues/923).

Since SAM doesn’t have a plugin system, I would have to wait for the SAM team to fix the problem.

Or, do I?

Since SAM is ultimately just CloudFormation with a magical macro called `AWS::Serverless-2016–10–31`. I can modify the CloudFormation template it transformed with my own macros.

In this case, we were able to get ourselves out of jail by writing a CloudFormation macro to:

- look for `AWS::ApiGateway::RestApi` CloudFormation resources
- iteratively remove any `credentials` fields from `AWS_PROXY` integrations

![](https://theburningmonk.com/wp-content/uploads/2019/05/img_5cddfe2b04691.png)

With this macro, we were able to unblock ourselves.

Admittedly, using CloudFormation macros is a rather heavy-handed approach to customize SAM’s behaviour! However, in the absence of a built-in mechanism for customizing SAM, it was the best bad idea we were able to come up with. Please let us know in the comments if you know of a simpler, more elegant solution!

p.s. Solve is looking for a backend engineer to join their team in Shoreditch, London. If you’re looking for an opportunity to work with serverless technologies and build games for millions of users, then you should consider applying!

The post [AWS SAM + Cloudformation macros, a patch made in heaven](https://theburningmonk.com/2019/05/aws-sam-cloudformation-macros-a-patch-made-in-heaven/) appeared first on [theburningmonk.com](https://theburningmonk.com).

 ![](http://feeds.feedburner.com/~r/theburningmonk/~4/9dcrx-qWydk)