API Gateway: AwsIntegration with Step Functions

Came up as a question on Gitter:

Hi I am new to CDK and trying to “Create a Step Functions API Using API Gateway” using java as follows

RestApi api = new RestApi(this, "api");
        AwsIntegrationProps awsIntegrationProps = AwsIntegrationProps.builder().withService("Step Functions")
            .withAction("StartExecution").build();

    AwsIntegration awsIntegration = new AwsIntegration(awsIntegrationProps);
    Resource resource = api.getRoot().addResource("execution");
    resource.addMethod("POST", awsIntegration);

But i am getting Error “Role ARN must be specified for AWS integrations (Service: AmazonApiGateway; Status Code: 400; Error Code: BadRequestException; Request ID: fa2f7fc8-0d5c-11e9-b2bf-ab94b16eea0c)” How do i specify Execution Role ? Ref aws doc https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-api-gateway.html

AWS integrations apparently always need a Role. The correct solution is to pass a RoleARN under the options key, but this is is validation plus a hint that we could have done locally.

Even better, we should make it as easy as on other L2 constructs to construct this required role (by doing so implicitly). We should also look into a way to set up the right permissions automatically.

[zxkane]

Hi, I wonder if there is any news related to this or if anyone would have a sample code to share for the apigateway2 integration.

I did it via L1 API.

[fumiyakk]

@Awlsring Sorry. I couldn’t show the raw code because it’s for work. So, I made some abstract code. It might be broken. I hope this could help you.

import * as cdk from '@aws-cdk/core';
import * as apigw from '@aws-cdk/aws-apigateway';
import * as iam from '@aws-cdk/aws-iam';

type Arns = { [key: string]: string }

export class SampleApiGatewayStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, Arns: Arns, props?: cdk.StackProps) {
    super(scope, id, props);
    
    const api = new apigw.RestApi(this, 'Api', {
      restApiName: 'stateApiName',
    });

    const sampleRole = new iam.Role(this, 'StepFunctionRole',{
      assumedBy: new iam.ServicePrincipal('apigateway.amazonaws.com')
    });

    sampleRole.addToPolicy(new iam.PolicyStatement({
      resources: ['*'],
      actions: ["states:*"]
    }));

    // Get StepFunctionArn
    const str1: string = "#set($inputRoot = $input.path('$')) {"
    const str2: string = `"input": "$util.escapeJavaScript($input.json('$'))",`
    const str3: string = `"stateMachineArn":"` 
    const str4: string = `"}`
    const templateString: string = str1 + str2 + str3 + Arns["stateMachineArn"] + str4

    const requestTemplates = {
      "application/json": templateString
    }

    // Connect stateMachine with api gateway
    const stateMachineIntegration = new apigw.AwsIntegration({
      service: "states",
      action: "sampleAction",
      options: {
        credentialsRole: sampleRole,
        requestTemplates: requestTemplates, 
      }
    });

    const process1 = api.root.addResource('preprocessing')
    const process2 = process1.addResource('v1')

    process2.addMethod('POST', stateMachineIntegration, {
      methodResponses: [{
        statusCode: '200',
      }]
    });
 }
}