HTTP API Support

Support HTTP API:

https://aws.amazon.com/blogs/compute/announcing-http-apis-for-amazon-api-gateway/

---

Proposal of a configuration schema within a Serverless Framework

Note: This proposal is “live” (updated in place whenever there’s an agreement on changes to it)

provider:
  # (optional) general API settings 
  httpApi:
    id: xxx # Attach to existing, already deployed, HTTP API id
    timeout: 5 # Default timeout for endpoints
    # Following options are supported only for HTTP API's to be created in context of this service
    cors: # Can also be set to `true` which will apply below defaults. If not set, there's no CORS
      allowedOrigins: "*"
      allowedHeaders: "*"
      allowMethods: "*"
      allowCredentials: true
      exposedResponseHeaders: "*"
      maxAge: 300

    authorizers:
      # JWT authorizers
      jwtAuthorizer:
        identitySource: $request.header.Authorization
        issuerUrl: <url>
        audience:
          - <audience1>
          - <audience2>

  # (optional) access logging for HTTP API 
  logs:
    httpApi: # Can also be set to `true` which will apply below defaults. If not set, no logs are written
      format: '{ "requestId":"$context.requestId", "ip": "$context.identity.sourceIp", "requestTime":"$context.requestTime", "httpMethod":"$context.httpMethod","routeKey":"$context.routeKey", "status":"$context.status","protocol":"$context.protocol", "responseLength":"$context.responseLength" }'

functions:
  # Individual HTTP route example
  users:
    handler: users.handler
    events:
      - httpApi:
          path: /users
          method: GET # Can be "*" as a catch-all for all HTTP methods for given path
          timeout: 5 # Optional, timeout in seconds
          authorizer: # Optional, if not set, endpoint is public
            name: jwtAuthorizer
            scopes:
              - user.id
              - user.email

  # Catch all other routes example
  api:
    handler: api.handler
    events:
      - httpApi:
          path: "*" # Once deployed, cannot be removed

In addition support for importing Open API objects can be added as:

provider:
  httpApi:
    # Endpoints configuration provided via Open API object
    openApi: # can be imported as e.g. ${file(open-api.json)}
      openapi: "3.0.0"
      info:
        title: "HTTP API example"
        version: "1.0.0"
      paths:
        /users:
          get:
            operationId: usersGet
          post:
            operationId: usersPost
        /other:
          get:
            operationId: other

functions:
  # Individual HTTP route example
  users:
    handler: users.handler
    events:
      - httpApi:
          operationId: usersGet # Match endpoint specified within Open API object
  # Catch all other specified routes example
  api:
    handler: api.handler
    events:
      - httpApi:
          operationId: "*"

Implementation roadmap

Implement and publish HTTP API support in following stages:

1. Basic routes support, no cors, no authorizers, no open API objects import (#7274, #7331 & #7383)
2. CORS support (#7336)
3. JWT authorizers support (#7346)
4. Access logs (#7385)
5. Support existing HTTP API’s (#7396)
6. Support timeout setting (#7401)
7. (eventually) Open API object support - possibly leave out for community to implement (when demand shows)

[medikoo]

@jplock We we will propose an implementation spec proposal next week, and actual implementation work should follow up shortly after we agree on most important details.

[vladgolubev]

Looks like CloudFormation support just landed: https://aws.amazon.com/about-aws/whats-new/2019/12/aws-cloudformation-updates-for-api-gateway-codepipeline-s3-iam-ecs-rds-es-lambda-and-more/

Create an HTTP API, JSON web tokens (JWTs) Authorizer and stage for HTTP API, and specify VPC endpoint IDs of an API to create Route53 aliases in Amazon API Gateway.