defaultMethodOptions should be selectively applied to CORS OPTIONS method

Tl;DR

defaultMethodOptions should exclude options method by default or at least have an option to do that.

Read More

LambdaRestApi has defaultMethodOption, when it is specified, it gets applied to all methods for given api resource. which is awesome but doesn’t work when CORS is involved.

Take this simple example, where I want all the methods to require x-api-key api key so I specify

defaultMethodOption: {
  apiKeyRequired: true
}

On top of this I also want CORS to be enabled on all api resources so in LambdaRestApi I also specify this

defaultCorsPreflightOptions : {
  ... cors options 
} 

Because of defaultCorsPreflightOptions an additional method will be created for all my resources to support CORS but because defaultMethodOption applies on all methods, options will also have apiKeyRequired , which it shouldn’t.

Environment

• CLI Version : 1.38
• Framework Version: 1.38
• Node.js Version: 12 -->
• OS :
• Language (Version): TypeScript (3.8.3) -->

This is 🐛 Bug Report

[whimzyLive]

@asterikx until issue is resolved correctly, you can use cdk escape hatches as also suggested by @nija-at.

For my case I did

    const corsMethods = this.apiV1.methods.filter(
      method => method.httpMethod === 'OPTIONS'
    );
    corsMethods.forEach(method => {
      const cfnMethod = method.node.defaultChild as CfnMethod;
      cfnMethod.addPropertyOverride('ApiKeyRequired', false);
      cfnMethod.addPropertyOverride('AuthorizationType', 'NONE');
      cfnMethod.addPropertyDeletionOverride('AuthorizerId');
    });

[github-actions[bot]]

This issue has received a significant amount of attention so we are automatically upgrading its priority. A member of the community will see the re-prioritization and provide an update on the issue.