{"action":"created","issue":{"url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/313","repository_url":"https://api.github.com/repos/awslabs/serverless-application-model","labels_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/313/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/313/comments","events_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/313/events","html_url":"https://github.com/awslabs/serverless-application-model/issues/313","id":299259249,"number":313,"title":"DependsOn AWS::Serverless:Api does not wait for all resources","user":{"login":"neonsamurai","id":1582455,"avatar_url":"https://avatars2.githubusercontent.com/u/1582455?v=4","gravatar_id":"","url":"https://api.github.com/users/neonsamurai","html_url":"https://github.com/neonsamurai","followers_url":"https://api.github.com/users/neonsamurai/followers","following_url":"https://api.github.com/users/neonsamurai/following{/other_user}","gists_url":"https://api.github.com/users/neonsamurai/gists{/gist_id}","starred_url":"https://api.github.com/users/neonsamurai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neonsamurai/subscriptions","organizations_url":"https://api.github.com/users/neonsamurai/orgs","repos_url":"https://api.github.com/users/neonsamurai/repos","events_url":"https://api.github.com/users/neonsamurai/events{/privacy}","received_events_url":"https://api.github.com/users/neonsamurai/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-02-22T08:24:16Z","updated_at":"2018-02-22T18:18:36Z","closed_at":null,"author_association":"NONE","body":"# Background\r\n\r\nI try deploying a serverless application which has a couple of Lambdas, an API gateway and I want to lock it behind an API key.\r\n\r\nWhen sending the definition to cloudformation with `aws cloudformation deploy` I notice that `DependsOn` does wait on the `RestApi` resource to be ready, but it does not wait on the `AWS:ApiGateway::Deployment` resource which also is created by SAM (but transparently).\r\n\r\nMy SAM.yaml for reference:\r\n\r\n```yaml\r\nAWSTemplateFormatVersion: '2010-09-09'\r\nTransform: 'AWS::Serverless-2016-10-31'\r\nDescription: Some API key protected serverless application\r\nParameters:\r\n  targetStage:\r\n    Description: Define stage to which Lambdas/API Gateways should be deployed.\r\n    Type: String\r\n    Default: dev\r\n    AllowedValues:\r\n      - dev\r\n      - test\r\n      - prod\r\n    ConstraintDescription: Only stages dev, test, prod are allowed\r\nGlobals:\r\n  Function:\r\n    Runtime: nodejs6.10\r\n    MemorySize: 128\r\n    Timeout: 6\r\nResources:\r\n  createFunction:\r\n    Type: 'AWS::Serverless::Function'\r\n    Properties:\r\n      Handler: create.handler\r\n      CodeUri: ../dist/deployment_package.zip\r\n      FunctionName: !Sub \"${AWS::StackName}-createCertificate-${targetStage}\"\r\n      Runtime: nodejs6.10\r\n      Description: Create or overwrite an IoT certificate with given params.\r\n      Role: 'arn:aws:iam::1234:role/my-role'\r\n  deleteFunction:\r\n    Type: 'AWS::Serverless::Function'\r\n    Properties:\r\n      Handler: delete.handler\r\n      CodeUri: ../dist/deployment_package.zip\r\n      FunctionName: !Sub \"${AWS::StackName}-deleteCertificate-${targetStage}\"\r\n      Runtime: nodejs6.10\r\n      Description: Delete an IoT certificate with given params.\r\n      Role: 'arn:aws:iam::1234:role/my-role'\r\n  restApi:\r\n    Type: AWS::Serverless::Api\r\n    Properties:\r\n      StageName: !Ref targetStage\r\n      DefinitionBody:\r\n        swagger: \"2.0\"\r\n        info:\r\n          version: \"2017-11-09T13:59:26Z\"\r\n          title: !Sub \"${AWS::StackName}-api-${targetStage}\"\r\n        basePath: !Sub \"/${targetStage}\"\r\n        schemes:\r\n          - \"https\"\r\n        paths:\r\n          /certificate:\r\n            post:\r\n              responses: {}\r\n              security:\r\n              - api_key: []\r\n              x-amazon-apigateway-integration:\r\n                uri: !Sub \"arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${createFunction.Arn}/invocations\"\r\n                passthroughBehavior: \"when_no_match\"\r\n                httpMethod: \"POST\"\r\n                type: \"aws_proxy\"\r\n            delete:\r\n              responses: {}\r\n              security:\r\n              - api_key: []\r\n              x-amazon-apigateway-integration:\r\n                uri: !Sub \"arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${deleteFunction.Arn}/invocations\"\r\n                passthroughBehavior: \"when_no_match\"\r\n                httpMethod: \"POST\"\r\n                type: \"aws_proxy\"\r\n        securityDefinitions:\r\n          api_key:\r\n            type: \"apiKey\"\r\n            name: \"x-api-key\"\r\n            in: \"header\"\r\n        x-amazon-apigateway-binary-media-types:\r\n          - \"application/octet-stream\"\r\n  apiKey:\r\n    Type: \"AWS::ApiGateway::ApiKey\"\r\n    DependsOn:\r\n      - restApi\r\n    Properties:\r\n      Name: !Sub \"${AWS::StackName}-apiKey-${targetStage}\"\r\n      Description: !Sub \"API key for: ${AWS::StackName} / ${targetStage}\"\r\n      Enabled: \"true\"\r\n      StageKeys:\r\n        - RestApiId: !Ref restApi\r\n          StageName: !Ref targetStage\r\n```\r\n\r\n# Expected behaviour\r\n\r\n`DependsOn` used to wait on a `AWS::Serverless:Api` should wait on all resources created by SAM for the API.\r\n\r\n# Actual behaviour\r\n\r\nThis causes CloudFormation to throw a `CREATE_FAILED | AWS::ApiGateway::ApiKey | apiKey | Invalid stage identifier specified` error during deployment, since the stage which I want to associate with the API key does not exist yet and I have no means of referencing the (future) stage or referencing the `AWS::ApiGateway::Deployment` in the `DependsOn`.\r\n\r\n# Thoughts\r\n\r\nThe only workaround I can think of for now is to build all `AWS::Serverless::Api` component resources (RestApi, Deployment, ApiKey) by hand and use `DependsOn` on the respective resource identifiers."},"comment":{"url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/comments/367772320","html_url":"https://github.com/awslabs/serverless-application-model/issues/313#issuecomment-367772320","issue_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/313","id":367772320,"user":{"login":"michaelj-smith","id":166787,"avatar_url":"https://avatars3.githubusercontent.com/u/166787?v=4","gravatar_id":"","url":"https://api.github.com/users/michaelj-smith","html_url":"https://github.com/michaelj-smith","followers_url":"https://api.github.com/users/michaelj-smith/followers","following_url":"https://api.github.com/users/michaelj-smith/following{/other_user}","gists_url":"https://api.github.com/users/michaelj-smith/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelj-smith/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelj-smith/subscriptions","organizations_url":"https://api.github.com/users/michaelj-smith/orgs","repos_url":"https://api.github.com/users/michaelj-smith/repos","events_url":"https://api.github.com/users/michaelj-smith/events{/privacy}","received_events_url":"https://api.github.com/users/michaelj-smith/received_events","type":"User","site_admin":false},"created_at":"2018-02-22T18:18:36Z","updated_at":"2018-02-22T18:18:36Z","author_association":"NONE","body":"I have seen similar behavior. Thanks for the detailed write-up!"}}
{"actor":{"display_login":"michaelj-smith"}}