Missing 'credentials' when the integration type is Lambda function

[AlexOugh]

Is this expected or is there anything I should add when running the command?

[isabinin]

Could you please provide more information what kind of credentials are missing?
Do you mean that "Invoke with caller credentials" flag is not exported into swagger file?

[AlexOugh]

In "x-amazon-apigateway-integration" section, I got type / httpMethod / uri, but 'credentials' is not present, which is to set the role that makes the API call the target Lambda function.

[isabinin]

Interesting, how did you create your API? Did you use API Gateway Importer or created it manually?
I tested it on different APIs that were created using API Gateway Importer and 'credentials' were exported.

[AlexOugh]

I created the API manually using the AWS API Gateway console.

[isabinin]

How do you specify the role when you select lambda integration type for your API resource/method?
When I tried to select lambda integration type using the AWS API Gateway console it didn't ask me to enter an execution role. When I exported the API -- 'credentials' were missing.

[AlexOugh]

Yes, it does NOT ask the role and it seems like adding a necessary role internally. I tried to find the role in IAM console, but couldn't. Not sure how they manage it.

[isabinin]

After some research I found this
http://docs.aws.amazon.com/apigateway/latest/developerguide/getting-started.html

Because the API Gateway console specifies for you the required invocation role/policy for the Lambda functions integrated with your API, you can skip the steps (below) to create the Lambda invocation role and its policy. However, if you set up the API without using the API Gateway console, such as when importing an API from Swagger, you must explicitly create, if necessary, and assign an invocation role/policy for the API Gateway to invoke the Lambda functions.

And I have the same observation: when I use API Gateway console for lambda integration it doesn't create or update anything in IAM. So looks like authorization is done internally.

To handle this case I can add a command line argument "default execution role". If no credentials were explicitly set for integration then it will use the default value while exporting.