No Policy created from IntrinsicVpceWhitelist

[altaurog]

Description

When attempting to create a private API with IntrinsicVpceWhitelist, the transform does not seem to include the resource policy I specify on AWS::Serverless::Api. Am I doing something wrong?

Steps to reproduce

Here is a minimal example:

AWSTemplateFormatVersion: 2010-09-09
Description: private api mwe
Transform: AWS::Serverless-2016-10-31

Resources:
  MWE:
    Type: AWS::Serverless::Api
    Properties:
      Name: private-api-mwe
      StageName: mwe
      EndpointConfiguration:
        Type: PRIVATE
      Auth:
        ResourcePolicy:
          IntrinsicVpceWhitelist:
            vpce-00000000000000000
      MethodSettings:
        - HttpMethod: "*"
          ResourcePath: "/*"

Observed result

When I deploy this stack, the following APIGateway error causes a failure creating a AWS::ApiGateway::Deployment resource: "Private REST API doesn't have a resource policy attached to it"

Here is the processed template:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "private api mwe",
  "Resources": {
    "MWEDeployment5332c373d4": {
      "Type": "AWS::ApiGateway::Deployment",
      "Properties": {
        "Description": "RestApi deployment id: 5332c373d45c69e6c0f562b4a419aa8eb311adc7",
        "RestApiId": {
          "Ref": "MWE"
        },
        "StageName": "Stage"
      }
    },
    "MWE": {
      "Type": "AWS::ApiGateway::RestApi",
      "Properties": {
        "Body": {
          "info": {
            "version": "1.0",
            "title": {
              "Ref": "AWS::StackName"
            }
          },
          "paths": {},
          "swagger": "2.0"
        },
        "Name": "private-api-mwe",
        "Parameters": {
          "endpointConfigurationTypes": "PRIVATE"
        },
        "EndpointConfiguration": {
          "Types": [
            "PRIVATE"
          ]
        }
      }
    },
    "MWEmweStage": {
      "Type": "AWS::ApiGateway::Stage",
      "Properties": {
        "DeploymentId": {
          "Ref": "MWEDeployment5332c373d4"
        },
        "RestApiId": {
          "Ref": "MWE"
        },
        "StageName": "mwe",
        "MethodSettings": [
          {
            "HttpMethod": "*",
            "ResourcePath": "/*"
          }
        ]
      }
    }
  }
}

Expected result

I believe ResourcePolicy should appear on the RestApi, and of course deploying the stack should work.

I have used very similar templates successfully in the past, but I see that the ResourcePolicy is not in the processed template of those stacks. Perhaps ApiGateway is more strict than it used to be?

Additional environment details

1. OS: linux
2. If using the SAM CLI, sam --version: deployed with my own script, using boto3 1.35.68
3. AWS region: us-east-1

[altaurog]

I see it works if I assign a function to it. ApiGateway complains that it has no method otherwise.

The following deploys successfully

AWSTemplateFormatVersion: 2010-09-09
Description: private api mwe
Transform: AWS::Serverless-2016-10-31

Resources:
  MWE:
    Type: AWS::Serverless::Api
    Properties:
      Name: private-api-mwe
      StageName: mwe
      EndpointConfiguration:
        Type: PRIVATE
      Auth:
        ResourcePolicy:
          IntrinsicVpceWhitelist:
            - vpce-00000000000000000
      MethodSettings:
        - HttpMethod: "*"
          ResourcePath: "/*"

  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      Events:
        ApiEvent:
          Type: Api
          Properties:
            Path: /
            Method: GET
            RestApiId: !Ref MWE
      Runtime: python3.12
      Handler: index.handler
      InlineCode: |
        def handler(event, context):
            return {'body': 'Hello World!', 'statusCode': 200}

Here is the processed template:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "private api mwe",
  "Resources": {
    "HelloWorldFunctionRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                "sts:AssumeRole"
              ],
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              }
            }
          ]
        },
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        ],
        "Tags": [
          {
            "Key": "lambda:createdBy",
            "Value": "SAM"
          }
        ]
      }
    },
    "MWE": {
      "Type": "AWS::ApiGateway::RestApi",
      "Properties": {
        "Body": {
          "info": {
            "version": "1.0",
            "title": {
              "Ref": "AWS::StackName"
            }
          },
          "paths": {
            "/": {
              "get": {
                "x-amazon-apigateway-integration": {
                  "httpMethod": "POST",
                  "type": "aws_proxy",
                  "uri": {
                    "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${HelloWorldFunction.Arn}/invocations"
                  }
                },
                "responses": {}
              }
            }
          },
          "swagger": "2.0",
          "x-amazon-apigateway-policy": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Action": "execute-api:Invoke",
                "Resource": [
                  {
                    "Fn::Sub": [
                      "execute-api:/${__Stage__}/GET/",
                      {
                        "__Stage__": "mwe"
                      }
                    ]
                  }
                ],
                "Effect": "Allow",
                "Principal": "*"
              },
              {
                "Action": "execute-api:Invoke",
                "Resource": [
                  {
                    "Fn::Sub": [
                      "execute-api:/${__Stage__}/GET/",
                      {
                        "__Stage__": "mwe"
                      }
                    ]
                  }
                ],
                "Effect": "Deny",
                "Condition": {
                  "StringNotEquals": {
                    "aws:SourceVpce": [
                      "vpce-00000000000000000"
                    ]
                  }
                },
                "Principal": "*"
              }
            ]
          }
        },
        "Name": "private-api-mwe",
        "Parameters": {
          "endpointConfigurationTypes": "PRIVATE"
        },
        "EndpointConfiguration": {
          "Types": [
            "PRIVATE"
          ]
        }
      }
    },
    "MWEDeployment106e128910": {
      "Type": "AWS::ApiGateway::Deployment",
      "Properties": {
        "Description": "RestApi deployment id: 106e128910f62544944e10cfeb2f074bf3b19eb5",
        "RestApiId": {
          "Ref": "MWE"
        },
        "StageName": "Stage"
      }
    },
    "HelloWorldFunctionApiEventPermissionmwe": {
      "Type": "AWS::Lambda::Permission",
      "Properties": {
        "Action": "lambda:InvokeFunction",
        "FunctionName": {
          "Ref": "HelloWorldFunction"
        },
        "Principal": "apigateway.amazonaws.com",
        "SourceArn": {
          "Fn::Sub": [
            "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/",
            {
              "__ApiId__": {
                "Ref": "MWE"
              },
              "__Stage__": "*"
            }
          ]
        }
      }
    },
    "HelloWorldFunction": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Code": {
          "ZipFile": "def handler(event, context):\n    return {'body': 'Hello World!', 'statusCode': 200}\n"
        },
        "Handler": "index.handler",
        "Role": {
          "Fn::GetAtt": [
            "HelloWorldFunctionRole",
            "Arn"
          ]
        },
        "Runtime": "python3.12",
        "Tags": [
          {
            "Key": "lambda:createdBy",
            "Value": "SAM"
          }
        ]
      }
    },
    "MWEmweStage": {
      "Type": "AWS::ApiGateway::Stage",
      "Properties": {
        "DeploymentId": {
          "Ref": "MWEDeployment106e128910"
        },
        "RestApiId": {
          "Ref": "MWE"
        },
        "StageName": "mwe",
        "MethodSettings": [
          {
            "HttpMethod": "*",
            "ResourcePath": "/*"
          }
        ]
      }
    }
  }
}

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.