API Gateway: LambdaRestApi defaultCorsPreflightOptions not attaching to children

[yutveg]

Describe the bug

I'm instantiating a LambdaRestApi with the defaultCorsPreflightOptions property. However, the OPTIONS method that handles the CORS configuration for that property is not automatically being attached to all child resources like the property claims.

Expected Behavior

I expected that defining the defaultCorsPreflightOptions would apply an OPTIONS method to all child resources of the API instance.

Current Behavior

Only the root resource has an OPTIONS method attached to it.

Reproduction Steps

Dependencies:

  "devDependencies": {
    "@types/jest": "^29.5.5",
    "@types/node": "20.7.1",
    "jest": "^29.7.0",
    "ts-jest": "^29.1.1",
    "aws-cdk": "2.101.0",
    "ts-node": "^10.9.1",
    "typescript": "~5.2.2"
  },
  "dependencies": {
    "aws-cdk-lib": "2.101.0",
    "constructs": "^10.0.0",
    "source-map-support": "^0.5.21"
  }

LambdaRestApi instance:

  this.restApi = new apiGateway.LambdaRestApi(
      this,
      `PricetoolLambdaRestApi${stage}`,
      {
        restApiName: `pt-lambda-rest-api-${stage}`,
        proxy: false,
        defaultCorsPreflightOptions: {
          allowOrigins: apiGateway.Cors.ALL_ORIGINS,
          allowMethods: apiGateway.Cors.ALL_METHODS,
          allowHeaders: ["*"],
        },
        deployOptions: {
          accessLogDestination: new apiGateway.LogGroupLogDestination(
            apiLogGroup
          ),
          accessLogFormat: apiGateway.AccessLogFormat.jsonWithStandardFields(),
          loggingLevel: apiGateway.MethodLoggingLevel.ERROR,
        },
        cloudWatchRole: true,
        cloudWatchRoleRemovalPolicy: cdk.RemovalPolicy.DESTROY,
        handler: new lambda.Function(this, `APIBaseLambda${stage}`, {
          functionName: `ptApiBase${stage}`,
          runtime: lambda.Runtime.NODEJS_16_X,
          handler: "index.handler",
          code: lambda.Code.fromInline(`
            exports.handler = async () => {
              return {
                statusCode: 200,
                body: "Hello, world!",
              };
            };
          `),
        }),
      }
    );

Possible Solution

No response

Additional Information/Context

I am configuring the API resources/methods/lambda integrations in a nested stack. I can supply the code for that if needed, I'm unsure if it's relevant.

CDK CLI Version

2.101.0

Framework Version

No response

Node.js Version

v18

OS

Linux

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi

According to the document, I believe if you attach to the root resources all the sub-tree resources should follow this configuration as well. Can you verify that?

[yutveg]

I could verify it but it would require a refactor on my part- it seems perhaps the documentation is simply not accurate? In the link you sent me for example it shows the following:

"The following example will enable CORS for all methods and all origins on all resources of the API:"

new apigateway.RestApi(this, 'api', {
  defaultCorsPreflightOptions: {
    allowOrigins: apigateway.Cors.ALL_ORIGINS,
    allowMethods: apigateway.Cors.ALL_METHODS // this is also the default
  }
})

I'm not sure if this is a bug or just an issue with the documentation. Thanks for the response, and apologies I don't currently have the time to verify your question.