Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

API Key was automatically and unintentionally replaced with migration from 6 to 7.6 #98

Closed
5 tasks done
AndreasEK opened this issue Mar 1, 2022 · 6 comments
Closed
5 tasks done
Assignees
Labels

Comments

@AndreasEK
Copy link

Before opening, please confirm:

  • I have installed the latest version of the Amplify CLI (see above), and confirmed that the issue still persists.
  • I have searched for duplicate or closed issues.
  • I have read the guide for submitting bug reports.
  • I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
  • I have removed any sensitive information from my code snippets and submission.

How did you install the Amplify CLI?

npm

If applicable, what version of Node.js are you using?

No response

Amplify CLI Version

7.6.21

What operating system are you using?

macos

Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No manual changes made

Amplify Categories

api

Amplify Commands

Not applicable

Describe the bug

Previously the statement to generate the api key had the identifier GraphQLAPIKey, after migrating the graphQL api, that changed to GraphQLAPIDefaultApiKey215A6DD7. Obviously, this resulted in the deletion of the old api key, and creation of a new one. Since this happened in a dev environment, this is manageable, but how do I prevent this behaviour in production?

previously generated api key:

    "GraphQLAPIKey": {
      "Type": "AWS::AppSync::ApiKey",
      "Properties": {
        "ApiId": {
          "Fn::GetAtt": [
            "GraphQLAPI",
            "ApiId"
          ]
        },
        "Description": "Stadt Solingen",
        "Expires": {
          "Fn::If": [
            "APIKeyExpirationEpochIsPositive",
            {
              "Ref": "APIKeyExpirationEpoch"
            },
            1677150274
          ]
        }
      },
      "Condition": "ShouldCreateAPIKey"
    },

new cloudformation-template.json

        "GraphQLAPIDefaultApiKey215A6DD7": {
            "Type": "AWS::AppSync::ApiKey",
            "Properties": {
                "ApiId": {
                    "Fn::GetAtt": [
                        "GraphQLAPI",
                        "ApiId"
                    ]
                },
                "Description": "Stadt Solingen",
                "Expires": 1677616131
            }
        },

Expected behavior

There should be a way to enforce the old naming pattern for the api key.

Reproduction steps

  1. add an api key to the graphql api with amplify cli 6.x
  2. switch to the latest amplify cli version and migrate the api

GraphQL schema(s)

# Put schemas below this line

Log output

# Put your logs below this line


Additional information

No response

@AndreasEK
Copy link
Author

So, one way to resolve this, is to override the api as follows. I think that procedure exposes another bug regarding the naming of the GraphQLAPIDefaultApiKey

import { AmplifyApiGraphQlResourceStackTemplate } from '@aws-amplify/cli-extensibility-helper';

export function override(resources: any) {
//    console.log(resources.api.GraphQLAPIDefaultApiKeyDefaultApiKey)
    resources.api.GraphQLAPIDefaultApiKeyDefaultApiKey.logicalId = "GraphQLAPIKey"
}

The type of resourcesshould be of AmplifyApiGraphQlResourceStackTemplate, but while the type AppsyncApiStack contains a member named GraphQLAPIDefaultApiKey, the actual member is called GraphQLAPIDefaultApiKeyDefaultApiKey (note the duplication of DefaultApiKey).

export interface AmplifyApiGraphQlResourceStackTemplate {
    api?: Partial<AppsyncApiStack>;
    models?: Partial<Record<string, ModelDirectiveStack>>;
    opensearch?: Partial<OpenSearchDirectiveStack & AppsyncStackCommon>;
    predictions?: Partial<PredictionsDirectiveStack & AppsyncStackCommon>;
}
export declare type AppsyncApiStack = {
    rootstack: CfnStack;
    GraphQLAPI: CfnGraphQLApi;
    GraphQLAPIDefaultApiKey?: CfnApiKey;
    GraphQLAPITransformerSchema?: CfnGraphQLSchema;
    GraphQLAPINONEDS?: CfnDataSource;
    AmplifyDataStore?: CfnTable;
    AmplifyDataStoreIAMRole?: CfnRole;
    DynamoDBAccess?: CfnPolicy;
};

I'm not really sure what's going on here, it's probably not the best way to fix it, but for now it will hopefully do.

@AndreasEK
Copy link
Author

Unfortunately, my fix doesn't work, since the Outputs still refer the other logicalId:

        "GraphQLAPIKeyOutput": {
            "Description": "Your GraphQL API ID.",
            "Value": {
                "Fn::GetAtt": [
                    "GraphQLAPIDefaultApiKey215A6DD7",
                    "ApiKey"
                ]
            },
            "Export": {
                "Name": {
                    "Fn::Join": [
                        ":",
                        [
                            {
                                "Ref": "AWS::StackName"
                            },
                            "GraphQLApiKey"
                        ]
                    ]
                }
            }
        },

@AndreasEK
Copy link
Author

@josefaidt is there any feedback or even an update on this?

@josefaidt
Copy link
Contributor

Hey @AndreasEK 👋 apologies for the delay here! Taking a look at this now

@josefaidt
Copy link
Contributor

Hey @AndreasEK 👋 thanks for raising this, and again, apologies for the delay! Upon further investigation I was able to confirm your note:

The type of resourcesshould be of AmplifyApiGraphQlResourceStackTemplate, but while the type AppsyncApiStack contains a member named GraphQLAPIDefaultApiKey, the actual member is called GraphQLAPIDefaultApiKeyDefaultApiKey (note the duplication of DefaultApiKey).

Using the following override we can run amplify build and see the first log statement prints false while the latter prints true, indicating the exposed name includes the duplicated DefaultApiKey

import { AmplifyApiGraphQlResourceStackTemplate } from '@aws-amplify/cli-extensibility-helper'

export function override(resources: AmplifyApiGraphQlResourceStackTemplate) {
  console.log(!!resources.api.GraphQLAPIDefaultApiKey)
  console.log(!!resources['api' as any].GraphQLAPIDefaultApiKeyDefaultApiKey)
}

For that issue, marking this as a bug. To override the logical ID of the GraphQL API Key, we can instead use overrideLogicalId which will change both the resource and outputs reference:

import { AmplifyApiGraphQlResourceStackTemplate } from '@aws-amplify/cli-extensibility-helper'

export function override(resources: AmplifyApiGraphQlResourceStackTemplate) {
  resources[
    'api' as any
  ].GraphQLAPIDefaultApiKeyDefaultApiKey.overrideLogicalId(
    'MyFancyGraphQLAPIKey'
  )
}

image

@josefaidt josefaidt added bug Something isn't working extensibility p2 and removed pending-triage labels Apr 6, 2022
@alharris-at alharris-at transferred this issue from aws-amplify/amplify-cli May 17, 2022
@sundersc sundersc self-assigned this Feb 20, 2024
@dpilch dpilch closed this as completed Apr 4, 2024
Copy link

github-actions bot commented Apr 4, 2024

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants