Schema validation done on request body but not request parameters

[himan085]

Hi, I've created a Smithy model for a resource with few constraints on the attributes. The OpenAPI schema generated after the build is being used in the AWS API Gateway. The constraints (traits) applied on the attributes are being validated for a create operation: HTTP POST API with a request body. But the constraints are not validated when I'm trying to perform a list operation: HTTP GET API with a query param.

Is there anything we need to do additionally to enable validation on the request parameters (GET) ? The validtaions on the request body (POST) worked out of the box.

Sample structure:

structure AWSResource {
    @required
    name: String

    @required
    number: AccountNumber
}

@length(min:1 , max: 20)
@pattern("^aws(/[0-9]{12}|)$")
string AccountNumber

@http(method: "POST", uri: "/resource")
operation CreateResource {
    input: CreateResourceRequest // depends on AWSResource structure
    output: CreateResourceResponse
    errors: [...]
}

@http(method: "GET", uri: "/resources")
@readonly
operation ListResources {
    input: ListResourcesInput
    output: ListResourcesOutput
    errors: [...]
}

@input
structure ListResourcesInput {
    @required
    @httpQuery("number")
    number: AccountNumber
}

[kstich]

The problem here is a gap in API Gateway's built-in validation. You should always be performing your own service-side validation of request values.

Path/Query/Header parameter JSON Schema based validations are not supported by API Gateway. In the API Gateway documentation for request validation, they state the following (emphasis added):

For validation, API Gateway verifies either or both of the following conditions:

• The required request parameters in the URI, query string, and headers of an incoming request are included and not blank.
• The applicable request payload adheres to the configured JSON schema request model of the method.

These correspond to the params-only (first bullet) and body-only (second bullet) options on the Smithy @aws.apigateway#requestValidator trait. With full just being both of these options.