diff --git a/aws_lambda_powertools/utilities/data_classes/api_gateway_authorizer_event.py b/aws_lambda_powertools/utilities/data_classes/api_gateway_authorizer_event.py index 6d05984128e..bcf035b61c0 100644 --- a/aws_lambda_powertools/utilities/data_classes/api_gateway_authorizer_event.py +++ b/aws_lambda_powertools/utilities/data_classes/api_gateway_authorizer_event.py @@ -520,8 +520,11 @@ def _add_route(self, effect: str, http_method: str, resource: str, conditions: l """Adds a route to the internal lists of allowed or denied routes. Each object in the internal list contains a resource ARN and a condition statement. The condition statement can be null.""" - if http_method != "*" and http_method not in HttpVerb.__members__: - allowed_values = [verb.value for verb in HttpVerb] + allowed_values = [verb.value for verb in HttpVerb] + if http_method in HttpVerb.__members__: + http_method = HttpVerb[http_method].value + + if http_method not in allowed_values: raise ValueError(f"Invalid HTTP verb: '{http_method}'. Use either '{allowed_values}'") if not self._resource_pattern.match(resource): diff --git a/tests/unit/data_classes/required_dependencies/test_api_gateway_authorizer.py b/tests/unit/data_classes/required_dependencies/test_api_gateway_authorizer.py index c26c1a417e7..cb2dc718036 100644 --- a/tests/unit/data_classes/required_dependencies/test_api_gateway_authorizer.py +++ b/tests/unit/data_classes/required_dependencies/test_api_gateway_authorizer.py @@ -130,6 +130,24 @@ def test_authorizer_response_deny_route(builder: APIGatewayAuthorizerResponse): } +def test_authorizer_response_deny_route_all_methods(builder: APIGatewayAuthorizerResponse): + builder.allow_all_routes() + builder.deny_route(http_method="ALL", resource="/admin/*") + + assert builder.asdict()["policyDocument"]["Statement"] == [ + { + "Action": "execute-api:Invoke", + "Effect": "Allow", + "Resource": ["arn:aws:execute-api:us-west-1:123456789:fantom/dev/*/*"], + }, + { + "Action": "execute-api:Invoke", + "Effect": "Deny", + "Resource": ["arn:aws:execute-api:us-west-1:123456789:fantom/dev/*/admin/*"], + }, + ] + + def test_authorizer_response_allow_route_with_conditions(builder: APIGatewayAuthorizerResponse): condition = {"StringEquals": {"method.request.header.Content-Type": "text/html"}} builder.allow_route(