feat: Support EndpointAccessMode property for AWS::Serverless::Api

[wandora58]

Issue #, if available

#3866

Description of changes

The SecurityPolicy property was added in a recent change.

When specifying a policy that begins with SecurityPolicy_ in the SecurityPolicy property, the EndpointAccessMode property must also be specified. This change is to pass through the EndpointAccessMode property directly to the API.

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-security-policies.html#apigateway-security-policies-endpoint-access-mode

Endpoint access mode is an additional parameter that you must specify for any REST API or custom domain name that uses an enhanced security policy that begins with SecurityPolicy_. You do this when you create your resource or if you change the security policy from a legacy policy to an enhanced policy.

Description of how you validated changes

unit & integration test

Checklist

• Review the generative AI contribution guidelines
• Adheres to the development guidelines
• Add/update transform tests
  • Using correct values
  • Using wrong values
• Add/update integration tests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[valerena]

It looks good. We're checking with other people from the API Gateway service team to confirm that everything is okay.

[iph]

Thanks for the PR! Some minor suggestions here and there around testing (and the random comment :) ).

I'm fine with it being in a separate PR (I can handle it after), but this doesn't solve for all use cases of EndpointAccessMode.

Essentially, you can add tls policies in 2 places:

• Rest APIs
• Custom Domains

hence, those are also the places you can add EndpointAccessMode. This covers Rest APIs but does not cover Custom Domains.

[rowanu]

Keen to have this so I can avoid adding a lot of CloudFormation 🙇 🙏 Thanks!

[wandora58]

support Custom Domains and enhance the unit and integration test

[iph]

lgtm!

[valerena]

Thanks for the contribution! This still needs to go through a deployment through the different AWS regions, so it will still take some time to be fully available.