feat(apigateway): resource policy configuration for private API

[badmintoncryer]

Issue # (if applicable)

Closes #31660.

Reason for this change

The same PR is closed during maintainer's review. (#31692)

To create a Private API Gateway, we need to attach a resource policy that allows access only from specific Interface VPC Endpoints, as shown below.

new apigateway.RestApi(this, 'PrivateRestApi', {
      endpointTypes: [apigateway.EndpointType.PRIVATE],
      handler: fn,
      policy: new iam.PolicyDocument({
        statements: [
          new iam.PolicyStatement({
            principals: [new iam.AnyPrincipal],
            actions: ['execute-api:Invoke'],
            resources: ['execute-api:/*'],
            effect: iam.Effect.DENY,
            conditions: {
              StringNotEquals: {
                "aws:SourceVpce": vpcEndpoint.vpcEndpointId
              }
            }
          }),
          new iam.PolicyStatement({
            principals: [new iam.AnyPrincipal],
            actions: ['execute-api:Invoke'],
            resources: ['execute-api:/*'],
            effect: iam.Effect.ALLOW
          })
        ]
      })
    })

This is a bit troublesome.

Description of changes

• Define IRestApi.addToResourcePolicy()
• Implement addToResourcePolicy() at RestApi, SpecApi, and imported RestApi class
• Implement RestApiBase.grantInvokeToVpcEndpoint()

In the grantInvokeToVpcEndpoint method, it was necessary to set a resource policy, and since a policy already existed in RestApiProps, I implemented it so that both can be used simultaneously.

Describe any new or updated permissions being added

Add 2 functions which modify resource policies.

Description of how you validated changes

Add both unit and integ tests.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.52%. Comparing base (ac3ffa5) to head (60520ba).
Report is 13 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #32719   +/-   ##
=======================================
  Coverage   81.52%   81.52%           
=======================================
  Files         222      222           
  Lines       13715    13715           
  Branches     2417     2417           
=======================================
  Hits        11181    11181           
  Misses       2254     2254           
  Partials      280      280           

Flag	Coverage Δ
suite.unit	81.52% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	80.97% <ø> (ø)
packages/aws-cdk-lib/core	82.09% <ø> (ø)

[go-to-k]

This adds something non-optional (a method that should be implemented compulsorily) to the interface. However, if a user has already created a custom construct that has implemented this IRestApi, this change will cause the CDK application to stop working. (It may be a Construct made in community, or it may be a Construct made within a company.)

The interface is a foundation of Construct and the medium used for communication between Constructs. So I'm wondering if we should avoid this sort of change, what do you think?

[badmintoncryer]

Thank you for your review! A valid point.
As an alternative, how about having the RestApiBase class implement the IResourceWithPolicy interface?

- export abstract class RestApiBase extends Resource implements IRestApi {
+ export abstract class RestApiBase extends Resource implements IRestApi, IResourceWithPolicy {

[go-to-k]

That's maybe good!

However, RestApiBase has been exported, so there may be a slight impact. But since you've created a PR, let's just make it up and leave the rest to the maintainer's discretion!

Because I don't think many users will extend RestApiBase instead of the interface :)

[go-to-k]

I haven't seen most of the code yet, so please give me a shout so I can look at it when you fix it.
(I haven't submitted change request yet, so if another community reviewers see it first, I'll leave it to them! So let's not resolve these comments for now, please.)

[badmintoncryer]

Thanks!

I'll update my code and ping you later.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 804b028
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository