[apigateway] Ability to specify custom cloudwatch role

[excavador]

Take a look there: https://github.com/aws/aws-cdk/blob/master/packages/%40aws-cdk/aws-apigateway/lib/restapi.ts#L505

Class SpecRestApi always invokes configureCloudWatchRole (in case if props.cloudWatchRole missed as well in case if props.cloudWatchRole specified)

aws-cdk/packages/@aws-cdk/aws-apigateway/lib/restapi.ts

Line 394 in 384f9cb

protected configureCloudWatchRole(apiResource: CfnRestApi) {

Method configureCloudWatchRole unconditionally create new role.

As result, props.cloudWatchRole option does not make any sense

Reproduction Steps

new apigateway.LambdaRestApi(.... { cloudWatchRole: <some role>})

What did you expect to happen?

AWS::ApiGateway::Account uses my role

What actually happened?

AWS::ApiGateway::Account uses unconditionally created role from configureCloudWatchRole

Environment

• CLI Version : does not matter
• Framework Version:: 1.61.0
• Node.js Version: does not matter
• OS : does not matter
• Language (Version): TypeScript (3.8.3)

---

This is 🐛 Bug Report

[nija-at]

cloudwatchRole is a boolean. Role creation and configuration will be skipped if you set it to false.

We currently don't have an option to configure your own role here. This can definitely be added. Is this what you're looking for?

[excavador]

cloudwatchRole is a boolean. Role creation and configuration will be skipped if you set it to false.

I missed it.

We currently don't have an option to configure your own role here. This can definitely be added. Is this what you're looking for?

Yes. I need some analogue of LogRetention role for lambda. When I have fine-grained project permissions, I need to follow our internal policy (role name/used managed policies).

That's why I am looking to ability to configure the CloudWatch role

[nija-at]

Marking this as a feature request.

@excavador - you can work around this by setting cloudwatchRole to false and configuring CfnAccount.

[excavador]

@nija-at thank you for workaround

[alvyn279]

I'm gonna pick this up if no one is taking it.

[nija-at]

@alvyn279 - this CfnAccount cloudwatch role area has a few holes here that needs a proper re-think and re-design.
We've got issues like #7140, #10722 and #10878 in our repo.

I would recommend picking something else up, if you're looking to contribute to the CDK. On the other hand, the workaround I've provided above should work if you're looking to fix this specific issue.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.