SAM Template for AWS Api Gateway Integration with S3 as AWS Service

Question

I am writing SAM templates and I want to create an API Gateway with the path as follows:-

http:///userFlights/airlines/static/images/{airlineName}.

This should be able to download the file from S3 bucket. The {airlineName} may have value like IndiGo.jpg.

I am able to create this manually. Nevertheless, the problem is I am not able to find the appropriate Documentation for SAM templates. I need to automate my API Gateway with SAM.

The values are as follows:- Integration type - AWS Service

AWS Region- eu-west-3

AWS Service - Simple Storage Service (S3

Http Method - GET

Path override- airlines/static/images/{airlineName}

Answer 1

You have to make use of an OpenAPI definition using DefinitionBody in your SAM template that defines the API configuration. Check out the S3 proxy example here. I have built an API with the simplest and minimum Swagger definition and deployed via SAM.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS SAM template with a S3 integration
Resources:
  ApiGatewayApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: prod
      DefinitionBody: {
        "swagger": "2.0",
        "info": {
          "version": "1.0"
        },
        "paths": {
          "/airlines/static/images/{airlineName}": {
            "get": {
              "produces": [
                "application/json"
              ],
              "responses": {
                "200": {
                  "description": "200 response"
                }
              },
              "x-amazon-apigateway-integration": {
                "responses": {
                  "default": {
                    "statusCode": "200"
                  }
                },
                "credentials": "arn:aws:iam::{account-id}:role/{role-name}",
                "uri": "arn:aws:apigateway:{aws-region}:s3:path/{bucket-name}",
                "passthroughBehavior": "when_no_match",
                "httpMethod": "GET",
                "type": "aws"
              }
            }
          }
        }
      }

Answer 2

This is a full working version, including role. Once deployed, in API Gateway in the AWS console goto stages, click GET, you'll see something like: https://12345hhhh.execute-api.eu-west-2.amazonaws.com/dev/{folder}/{item}

Replace {folder} and {item} for your S3 folder name and s3 item (object) (without the {}) it should GET the resource

The openApi swagger doc was taken directly (slightly cut down for simplicity) from AWS docs, if you need the full version with additional functionality it's here: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-as-s3-proxy-export-swagger-with-extensions.html

You may want to lock down the bucket instead of '*' and there is no authentication included in this example

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS SAM template for AWS API Gateway with S3 proxy AWS integration
Resources:
  # roles
  s3AWSIntegrationExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
      RoleName: s3AWSIntegrationExecutionRole

  # policies
  apiGatewayExecutionPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-apiGatewayExecutionPolicy
      Roles:
        - Ref: s3AWSIntegrationExecutionRole
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Action:
              - s3:GetObject
              - s3:PutObject
              - s3:ListBucket
            Resource: '*'
          -
            Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:DescribeLogStreams
              - logs:PutLogEvents
            Resource: '*'

  # API Gateway
  ApiGatewayApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: dev
      Auth:
        DefaultAuthorizer:
          NONE
      DefinitionBody: {
        "swagger": "2.0",
        "info": {
          "version": "2016-10-13T23:04:43Z",
          "title": "MyS3"
        },
        "basePath": "/S3",
        "schemes": [
          "https"
        ],
        "paths": {
          "/{folder}/{item}": {
            "get": {
              "produces": [
                "application/json"
              ],
              "parameters": [
                {
                  "name": "item",
                  "in": "path",
                  "required": true,
                  "type": "string"
                },
                {
                  "name": "folder",
                  "in": "path",
                  "required": true,
                  "type": "string"
                }
              ],
              "responses": {
                "200": {
                  "description": "200 response",
                  "schema": {
                    "$ref": "#/definitions/Empty"
                  },
                  "headers": {
                    "content-type": {
                      "type": "string"
                    },
                    "Content-Type": {
                      "type": "string"
                    }
                  }
                },
                "400": {
                  "description": "400 response"
                },
                "500": {
                  "description": "500 response"
                }
              },
              "security": [
                {
                  "sigv4": []
                }
              ],
              "x-amazon-apigateway-integration": {
                "credentials": !GetAtt s3AWSIntegrationExecutionRole.Arn,
                "responses": {
                  "4\\d{2}": {
                    "statusCode": "400"
                  },
                  "default": {
                    "statusCode": "200",
                    "responseParameters": {
                      "method.response.header.content-type": "integration.response.header.content-type",
                      "method.response.header.Content-Type": "integration.response.header.Content-Type"
                    }
                  },
                  "5\\d{2}": {
                    "statusCode": "500"
                  }
                },
                "requestParameters": {
                  "integration.request.path.object": "method.request.path.item",
                  "integration.request.path.bucket": "method.request.path.folder"
                },
                "uri": "arn:aws:apigateway:eu-west-2:s3:path/{bucket}/{object}",
                "passthroughBehavior": "when_no_match",
                "httpMethod": "GET",
                "type": "aws"
              }
            }
          }
        }
      }