HTTP API integrations aren't updated to use the deployment alias

[samhanes-fs]

trafficstars

What are the steps to reproduce this issue?

Create a function with an httpApi event and a deploymentConfiguration:

functions:
  http:
    handler: dist/lambda/http.http
    events:
      - httpApi: '*'
    deploymentSettings:
      type: AllAtOnce
      alias: Live
      preTrafficHook: deployPreTraffic

What happens?

The AWS::Lambda::Permission resource for the integration is correctly updated to point to the AWS::Lambda::Alias resource for the function's live alias, but the AWS::ApiGatewayV2::Integration resource still points to the AWS::Lambda::Function resource:

    "HttpApiIntegrationHttp": {
      "Type": "AWS::ApiGatewayV2::Integration",
      "Properties": {
        "ApiId": {
          "Ref": "HttpApi"
        },
        "IntegrationType": "AWS_PROXY",
        "IntegrationUri": {
          "Fn::GetAtt": [
            "HttpLambdaFunction",
            "Arn"
          ]
        },
        "PayloadFormatVersion": "1.0",
        "TimeoutInMillis": 20500
      }
    },

This results in the API Gateway returning 500 errors for that integration with the message "The IAM role configured on the integration or API Gateway doesn't have permissions to call the integration. Check the permissions and try again." because it only has permissions on the live alias, not on the bare function ARN it's using.

What were you expecting to happen?

The AWS::ApiGatewayV2::Integration resource should be overridden to point to the AWS::Lambda::Alias resource for the function's live alias just like the AWS::Lambda::Permission resource is.

    "HttpApiIntegrationHttp": {
      "Type": "AWS::ApiGatewayV2::Integration",
      "Properties": {
        "ApiId": {
          "Ref": "HttpApi"
        },
        "IntegrationType": "AWS_PROXY",
        "IntegrationUri": {
          "Ref": "HttpLambdaFunctionAliasLive"
        },
        "PayloadFormatVersion": "1.0",
        "TimeoutInMillis": 20500
      }
    },

Any logs, error output, etc?

Nope.

Any other comments?

It's possible to work around this issue by overriding the integration URI for all your httpApi events to point to the alias, e.g.

resources:
  extensions:
    HttpApiIntegrationHttp:
      Properties:
        IntegrationUri: {Ref: HttpLambdaFunctionAliasLive}

What versions of software are you using?

serverless: 1.78.1
serverless-plugin-canary-deployments: 0.4.8