Bug: API Gateway authorizer does not normalize the ALL HTTP verb

[leandrodamascena]

Expected Behaviour

Passing the accepted HttpVerb.ALL member name to deny_route produces an ARN containing the wildcard HTTP method *.

Current Behaviour

"ALL" passes validation because validation checks enum member names. The ARN builder then uses the literal string and produces a resource containing /ALL/, which does not match API Gateway request methods.

Code snippet

from aws_lambda_powertools.utilities.data_classes.api_gateway_authorizer_event import (
    APIGatewayAuthorizerResponse,
)

policy = APIGatewayAuthorizerResponse(
    principal_id="user",
    region="us-east-1",
    aws_account_id="123456789012",
    api_id="api-id",
    stage="prod",
)
policy.deny_route(http_method="ALL", resource="/admin/*")

print(policy.asdict()["policyDocument"]["Statement"])

Possible Solution

Normalize accepted enum member names to their values before constructing the resource ARN, then validate against the enum values. "ALL" becomes "*", while existing HTTP verbs and the wildcard retain their current behavior.

Steps to Reproduce

1. Install Powertools for AWS Lambda (Python) v3.34.0.
2. Run the snippet.
3. Observe that the Deny resource contains /ALL/admin/* instead of /*/admin/*.

Powertools for AWS Lambda (Python) version

3.34.0

AWS Lambda function runtime

3.13

Packaging format used

PyPi

Debugging logs

No logs. Inspect the generated policy document.

[nirajkumarbarot]

Hey @leandrodamascena, I'd like to work on this bug fix!

I'll normalize the HTTP verb before constructing the ARN so that "ALL" maps to "*" as expected.