fix(apigateway): race condition exists between stage and cfnaccount in specrestapi

packages/@aws-cdk/aws-apigateway/lib/restapi.ts

@@ -662,16 +662,16 @@ export class SpecRestApi extends RestApiBase {
     this.restApiRootResourceId = resource.attrRootResourceId;
     this.root = new RootResource(this, {}, this.restApiRootResourceId);
 
-    this._configureDeployment(props);
-    if (props.domainName) {
-      this.addDomainName('CustomDomain', props.domainName);
-    }
-
     const cloudWatchRoleDefault = FeatureFlags.of(this).isEnabled(APIGATEWAY_DISABLE_CLOUDWATCH_ROLE) ? false : true;
     const cloudWatchRole = props.cloudWatchRole ?? cloudWatchRoleDefault;
     if (cloudWatchRole) {
       this._configureCloudWatchRole(resource);
     }
+
+    this._configureDeployment(props);
+    if (props.domainName) {
+      this.addDomainName('CustomDomain', props.domainName);
+    }
   }
 }
 

packages/@aws-cdk/aws-apigateway/test/api-definition.asset.integ.snapshot/integtest-restapi-fromdefinition-asset.template.json

@@ -80,7 +80,10 @@
      "Ref": "myapiDeployment92F2CB49d7e5c9cfe50a1616e1cef4517d6b8f96"
     },
     "StageName": "prod"
-   }
+   },
+   "DependsOn": [
+    "myapiAccountEC421A0A"
+   ]
   },
   "myapiCloudWatchRole095452E5": {
    "Type": "AWS::IAM::Role",

packages/@aws-cdk/aws-apigateway/test/api-definition.inline.integ.snapshot/integtest-restapi-fromdefinition-inline.template.json

@@ -72,7 +72,10 @@
      "Ref": "myapiDeployment92F2CB49a59bca458e4fac1fcd742212ded42a65"
     },
     "StageName": "prod"
-   }
+   },
+   "DependsOn": [
+    "myapiAccountEC421A0A"
+   ]
   },
   "myapiCloudWatchRole095452E5": {
    "Type": "AWS::IAM::Role",

packages/@aws-cdk/aws-apigateway/test/spec-restapi.integ.snapshot/test-apigateway-spec-restapi.template.json

@@ -517,7 +517,10 @@
      }
     ],
     "StageName": "beta"
-   }
+   },
+   "DependsOn": [
+    "myapiAccountEC421A0A"
+   ]
   },
   "myapiCloudWatchRole095452E5": {
    "Type": "AWS::IAM::Role",

packages/@aws-cdk/aws-apigateway/test/stage.test.ts

@@ -70,7 +70,7 @@ describe('stage', () => {
     });
   });
 
-  test('stage depends on the CloudWatch role when it exists', () => {
+  test('RestApi - stage depends on the CloudWatch role when it exists', () => {
     // GIVEN
     const stack = new cdk.Stack();
     const api = new apigateway.RestApi(stack, 'test-api', { cloudWatchRole: true, deploy: false });
@@ -80,6 +80,23 @@ describe('stage', () => {
     // WHEN
     new apigateway.Stage(stack, 'my-stage', { deployment });
 
+    // THEN
+    Template.fromStack(stack).hasResource('AWS::ApiGateway::Stage', {
+      DependsOn: ['testapiAccount9B907665'],
+    });
+  });
+
+  test('SpecRestApi - stage depends on the CloudWatch role when it exists', () => {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const api = new apigateway.SpecRestApi(stack, 'test-api', { apiDefinition: apigateway.ApiDefinition.fromInline( { foo: 'bar' }) });
+    const deployment = new apigateway.Deployment(stack, 'my-deployment', { api });
+    api.root.addMethod('GET');
+
+    // WHEN
+    new apigateway.Stage(stack, 'my-stage', { deployment });
+
+    // THEN
     Template.fromStack(stack).hasResource('AWS::ApiGateway::Stage', {
       DependsOn: ['testapiAccount9B907665'],
     });