如何仅允许IP/范围访问AWS API Gateway资源 [英] How to allow only an IP/range access to AWS API Gateway resources

问题描述

如何最好地通过IP限制对AWS API网关中某些路由的访问? 我只允许我的ECS群集访问API网关中的某些路由.我尝试将ECS NAT网关(VPC CIDR范围)放在aws:SourceIp中，但始终被拒绝.我什至尝试了我的个人计算机的公共IP地址...相同的结果...这是正确的方法吗?还是应该尝试IAM授权者? IAM授权者的缺点是我需要签署我的API调用吗?也许使用API​​ Gateway SDK?这意味着我更希望避免代码更改.

{
  "Id": "MY_API_POLICY",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": ["XX.XX.XX.XX/32"]
        }
      },
      "Resource": [
        "arn:aws:execute-*:*:apiid/stagename/*/private/route"
      ]
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": [
        "arn:aws:execute-*:*:apiid/stagename/*/public/route"
      ]
    }
  ]
}

解决方案

正如@Visal所述，限制ip/范围是正确的方法.这是示例: https://aws.amazon.com/de/blogs/compute/control-access-to-your-apis-using-amazon-api-gateway-resource-policies/

有一个允许访问特定IP范围的策略的示例:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::<account_idA>:user/<user>",
                    "arn:aws:iam::<account_idA>:root"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*/*/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": " 203.0.113.0/24"
                }
            }
        }
    ]
}

或者，如果您想拒绝访问，则可以找到以下政策:

{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "execute-api:Invoke",
    "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*",
    "Condition": {
        "IpAddress": {
            "aws:SourceIp": "203.0.113.0/24"
        }
    }
}

How best can I restrict access to certain routes in AWS API gateway by IP? I want to allow only my ECS cluster to access certain routes in API gateway. I tried putting the ECS NAT gateway, the VPC CIDR range in aws:SourceIp but always get denied. I even tried my personal computer public IP address ... same results ... Is this the correct way? Or should I try IAM authorizers? The downside with IAM authorizer is I need to sign my API calls? Perhaps using the API Gateway SDK? Which means code change I prefer to avoid.

{
  "Id": "MY_API_POLICY",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": ["XX.XX.XX.XX/32"]
        }
      },
      "Resource": [
        "arn:aws:execute-*:*:apiid/stagename/*/private/route"
      ]
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": [
        "arn:aws:execute-*:*:apiid/stagename/*/public/route"
      ]
    }
  ]
}

解决方案

As @Visal already mentioned is restricting the ip/range is the correct way. Here is the example: https://aws.amazon.com/de/blogs/compute/control-access-to-your-apis-using-amazon-api-gateway-resource-policies/

There is an example for a policy that allows the access for a certain ip range:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::<account_idA>:user/<user>",
                    "arn:aws:iam::<account_idA>:root"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*/*/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": " 203.0.113.0/24"
                }
            }
        }
    ]
}

Or if you want to deny the access then you will find this policy:

{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "execute-api:Invoke",
    "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*",
    "Condition": {
        "IpAddress": {
            "aws:SourceIp": "203.0.113.0/24"
        }
    }
}

这篇关于如何仅允许IP/范围访问AWS API Gateway资源的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！