serverless: API Keys don't work unless attached to a usage plan

This is a Bug Report

Description

Creating API Keys and marking endpoints as private does not actually enable those API keys to be used against any endpoints in API Gateway. Instead those endpoints just return 403 Forbidden, whether you provide an API key or not.

In order for API keys to work, you need to:

Create a usage plan (it does not have to have any throttling or quota)
Add your API and stage to the usage plan
Add your API key to the usage plan

I haven’t got a proposal at present for how serverless could support usage plans, just informing that API keys do not currently work as specified in serverless documentation without extra manual work setting up the usage plan.

Similar or dependent issues:

#2058

About this issue

Original URL
State: closed
Created 8 years ago
Reactions: 24
Comments: 16 (8 by maintainers)

Most upvoted comments

Usage plan support was introduced recently: https://aws.amazon.com/de/about-aws/whats-new/2017/03/aws-cloudformation-supports-authoring-templates-with-code-references-and-amazon-vpc-peering/

+10

pmuens on Mar 29, 2017

the documentation says this is optional https://serverless.com/framework/docs/providers/aws/events/apigateway#setting-api-keys-for-your-rest-api

When using API keys, you can optionally define usage plan quota and throttle, using usagePlan object.

Is this really the case?

softprops on Dec 6, 2017

@pmuens, have you already started to implement this? I ran into the same problem and I could try to fix this. It is now possible to with AWS::ApiGateway::UsagePlan and AWS::ApiGateway::UsagePlanKey. At least it worked when I created an API Gateway with vanilla CloudFormation (which is a horrible task to do compared how easy it is with the Serverless…).

laardee on May 31, 2017

Just leaving these links here: http://stackoverflow.com/questions/39910734/can-you-create-usage-plan-with-cloud-formation and http://stackoverflow.com/questions/39992629/usageplankeys-cloudformation

I started to work on this today as our integration tests (see #2655) also suffer from this. Unfortunately you can only create the usage plan but not associate a key with a usage plan through CloudFormation right now. This lack of functionality makes it not possible to implement this right now 😢

pmuens on Nov 17, 2016

According to the Cloud Formation Documentation it is possible to create a usage plan with Cloud Formation, BUT it does not say anything about assigning an API Key to a Usage Plan. That would cover half our problem at least. It’s something

ansraliant on Oct 25, 2016

@FarwaCielo usagePlan had been added to provider in v1.16.0 long time ago.

However, usagePlan is defined in custom in the configuration you attached. Perhaps you use a plugin that configure usagePlan via custom.usagePlan ? If so, the issue should be reported to the plugin. Or you may try the official support of usagePlan.

thanks a lot for the prompt reply @exoego . My issue is now fixed. I have updated my answer too.

FarwaCielo on Feb 26, 2019