fix: surface user-facing errors for malformed Auth.securityDefinitions and Domain.AccessAssociation (#3923)

Author: roger-zhangg

samtranslator/model/api/api_generator.py

@@ -1589,6 +1589,10 @@ def _generate_domain_access_association(
         """
         Generate domain access association resource
         """
+        # Validate before .get() so a non-map (e.g. a string) raises a user-facing
+        # error pointing at the resource and property instead of an opaque
+        # AttributeError surfaced as "Internal transform failure".
+        sam_expect(domain_access_association, self.logical_id, "Domain.AccessAssociation").to_be_a_map()
         vpcEndpointId = domain_access_association.get("VpcEndpointId")
         logical_id = LogicalIdGenerator("DomainNameAccessAssociation", [vpcEndpointId, domain_logical_id]).gen()
 

samtranslator/swagger/swagger.py

@@ -475,6 +475,11 @@ def add_authorizers_security_definitions(self, authorizers):  # type: ignore[no-
         :param list authorizers: List of Authorizer configurations which get translated to securityDefinitions.
         """
         self.security_definitions = self.security_definitions or Py27Dict()
+        if not isinstance(self.security_definitions, dict):
+            # The user's DefinitionBody supplied securityDefinitions as a non-dict
+            # (e.g. a YAML list). Indexing self.security_definitions[name] below
+            # would raise an opaque TypeError; surface a user-facing error instead.
+            raise InvalidTemplateException("securityDefinitions must be a dictionary.")
 
         for authorizer_name, authorizer in authorizers.items():
             self.security_definitions[authorizer_name] = authorizer.generate_swagger()

tests/translator/input/error_api_domain_access_association_not_dict.yaml

@@ -0,0 +1,14 @@
+Resources:
+  MyApi:
+    Type: AWS::Serverless::Api
+    Properties:
+      StageName: Prod
+      Domain:
+        DomainName: example.com
+        CertificateArn: arn:aws:acm:us-east-1:111111111111:certificate/abcd
+        EndpointConfiguration: PRIVATE
+        # Malformed: AccessAssociation must be a map (with VpcEndpointId).
+        # Previously this crashed the transform with a Python
+        # `AttributeError: 'str' object has no attribute 'get'`, which
+        # CloudFormation surfaced as "Internal transform failure".
+        AccessAssociation: vpce-1234567890abcdef0

tests/translator/input/error_api_securitydefinitions_not_dict.yaml

@@ -0,0 +1,27 @@
+Resources:
+  MyApi:
+    Type: AWS::Serverless::Api
+    Properties:
+      StageName: Prod
+      Auth:
+        Authorizers:
+          MyAuth:
+            FunctionArn: arn:aws:lambda:us-east-1:111111111111:function:authfn
+            FunctionPayloadType: TOKEN
+        DefaultAuthorizer: MyAuth
+      # Malformed: securityDefinitions must be a dict, not a list. When SAM
+      # tried to attach the authorizer it indexed the list with a string and
+      # crashed the transform with a Python
+      # `TypeError: list indices must be integers or slices, not Py27UniStr`,
+      # which CloudFormation surfaced as "Internal transform failure".
+      DefinitionBody:
+        swagger: '2.0'
+        info:
+          title: MyApi
+          version: '1.0'
+        securityDefinitions:
+        - InvalidEntryShouldBeDict
+        paths:
+          /:
+            get:
+              responses: {}

tests/translator/output/error_api_domain_access_association_not_dict.json

@@ -0,0 +1,14 @@
+{
+  "_autoGeneratedBreakdownErrorMessage": [
+    "Invalid Serverless Application Specification document. ",
+    "Number of errors found: 1. ",
+    "Resource with id [MyApi] is invalid. ",
+    "Property 'Domain.AccessAssociation' should be a map."
+  ],
+  "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [MyApi] is invalid. Property 'Domain.AccessAssociation' should be a map.",
+  "errors": [
+    {
+      "errorMessage": "Resource with id [MyApi] is invalid. Property 'Domain.AccessAssociation' should be a map."
+    }
+  ]
+}

tests/translator/output/error_api_securitydefinitions_not_dict.json

@@ -0,0 +1,14 @@
+{
+  "_autoGeneratedBreakdownErrorMessage": [
+    "Invalid Serverless Application Specification document. ",
+    "Number of errors found: 1. ",
+    "Structure of the SAM template is invalid. ",
+    "securityDefinitions must be a dictionary."
+  ],
+  "errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Structure of the SAM template is invalid. securityDefinitions must be a dictionary.",
+  "errors": [
+    {
+      "errorMessage": "Structure of the SAM template is invalid. securityDefinitions must be a dictionary."
+    }
+  ]
+}