AWS CDK の特定バージョン(2.142.0 から 2.148.0)で CognitoUserPoolsAuthorizer の認可スコープが設定されないバグが発生していたので対処方法を確認してみた

Subject:
[Action Recommended] Update to AWS CDK version v2.148.1 or newer [AWS Account: XXXXXXXXXXXX]

Body:
Hello,

We are aware of an issue [1] in AWS Cloud Development Kit (CDK) [2] versions 2.142.0 through 2.148.0 that, under certain conditions, could result in granting authenticated Amazon Cognito users broader access than intended. We have proactively notified customers affected by this issue. If you use these versions, we recommend you upgrade to v2.148.1 or newer [3].

For these versions, if your application uses the “RestApi” construct [4] with “CognitoUserPoolsAuthorizer” [5] as the authorizer, and you limit access to specific API resources or methods using authorization scopes, your applications designed to make changes would allow changes by a user who previously did not have permission to do so. We identified you are not affected by this issue, however, as a security best practice, we recommend you upgrade to v2.148.1 or newer.

If you have questions or concerns, please contact AWS Support [6] or follow up with your account team.

[1] https://github.com/aws/aws-cdk/issues/30444
[2] https://docs.aws.amazon.com/cdk/v2/guide/home.html
[3] https://docs.aws.amazon.com/cdk/v2/guide/getting_started.html#getting_started_install
[4] https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_apigateway.RestApi.html
[5] https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_apigateway.CognitoUserPoolsAuthorizer.html
[6] https://aws.amazon.com/support

Sincerely,
Amazon Web Services

Amazon Web Services, Inc. is a subsidiary of [Amazon.com](http://amazon.com/), Inc. [Amazon.com](http://amazon.com/) is a registered trademark of [Amazon.com](http://amazon.com/), Inc. This message was produced and distributed by Amazon Web Services Inc., 410 Terry Ave. North, Seattle, WA 98109-5210

npm install aws-cdk@2.141.0 aws-cdk-lib@2.141.0

import { UserPool, OAuthScope } from 'aws-cdk-lib/aws-cognito';
import {
  CognitoUserPoolsAuthorizer,
  RestApi,
} from 'aws-cdk-lib/aws-apigateway';
import { Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export class CdkSampleStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // User Poolの作成
    const userPool = new UserPool(this, 'UserPool');

    // Cognito User Pools Authorizerの作成
    const authorizer = new CognitoUserPoolsAuthorizer(this, 'Authorizer', {
      cognitoUserPools: [userPool],
    });

    // RestApiの作成
    const restApi = new RestApi(this, 'RestApi');

    // ルートリソースの取得
    const rootResource = restApi.root;

    // ルートリソースにGETメソッドを追加し、オーソライザーを設定
    rootResource.addMethod('GET', undefined, {
      authorizer,
      authorizationScopes: [OAuthScope.PROFILE.scopeName], // 認可スコープを指定する
    });
  }
}

npm install aws-cdk@2.142.0 aws-cdk-lib@2.142.0

$ npx cdk diff
[Warning at /SampleStack/RestApi/Default/GET] 'AuthorizationScopes' can only be set when 'AuthorizationType' sets 'COGNITO_USER_POOLS'. Default to ignore the values set in 'AuthorizationScopes'. [ack: @aws-cdk/aws-apigateway:invalidAuthScope]
Stack SampleStack
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
Resources
[-] AWS::ApiGateway::Deployment RestApi/Deployment RestApiDeployment180EC503aed52c5a4c8b74d82224d289a0734b8a destroy
[+] AWS::ApiGateway::Deployment RestApi/Deployment RestApiDeployment180EC503e916070d7fdf2402bf059f6e97faf48e
[~] AWS::ApiGateway::Stage RestApi/DeploymentStage.prod RestApiDeploymentStageprod3855DE66
 └─ [~] DeploymentId
     └─ [~] .Ref:
         ├─ [-] RestApiDeployment180EC503aed52c5a4c8b74d82224d289a0734b8a
         └─ [+] RestApiDeployment180EC503e916070d7fdf2402bf059f6e97faf48e
[~] AWS::ApiGateway::Method RestApi/Default/GET RestApiGET0F59260B
 └─ [-] AuthorizationScopes
     └─ ["profile"]

✨  Number of stacks with differences: 1

// ルートリソースにGETメソッドを追加し、オーソライザーを設定
rootResource.addMethod('GET', undefined, {
  authorizer,
  authorizationScopes: [OAuthScope.PROFILE.scopeName], // スコープを指定する
  authorizationType: AuthorizationType.COGNITO, // COGNITO_USER_POOLS を明示的に指定する
});

$ npx cdk diff
Stack SampleStack
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
There were no differences

✨  Number of stacks with differences: 0

npm install aws-cdk@2.148.1 aws-cdk-lib@2.148.1

// ルートリソースにGETメソッドを追加し、オーソライザーを設定
rootResource.addMethod('GET', undefined, {
  authorizer,
  authorizationScopes: [OAuthScope.PROFILE.scopeName], // スコープを指定する
  // authorizationType: AuthorizationType.COGNITO, // COGNITO_USER_POOLS を明示的に指定する
});

$ npx cdk diff
Stack SampleStack
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
There were no differences

✨  Number of stacks with differences: 0