带有Lambda Authorizer的AWS API Gateway [英] AWS API Gateway with Lambda Authorizer

问题描述

我正在尝试配置一个API网关，该网关从请求路径中获取代理参数，并从Lambda授权者返回的参数中并将其放入标头中，以便可以将其传递给运行的Elastic Beanstalk REST API春季靴.

I am trying to configure an API Gateway which takes a proxy parameter from the request path, and also a parameter from the Lambda authorizer return and put it in the header, so that it can be passed to my Elastic Beanstalk REST API running Spring Boot.

代理路径按预期方式工作；并且我看到Lambda函数根据文档在上下文"映射中返回变量"x-api-auth".

The proxy path is working as expected; and I see my Lambda function is returning the variable "x-api-auth" in the "context" map as per documentation.

唯一不起作用的方法是在请求标头中添加"x-api-auth". :(每当我运行我的Jenkins构建以更新Cloudformation堆栈时，都会出现此错误:

The only piece not working is adding "x-api-auth" to the request header. :( Whenever I ran my Jenkins build to update the Cloudformation stack, I get this error:

Errors found during import: Unable to put integration on 'ANY' for resource at path '/sfdc/v1/feature-api/{proxy+}': Invalid mapping expression specified: Validation Result: warnings : [], errors : [Invalid mapping expression specified: $context.authorizer.x-api-auth] (Service: AmazonApiGateway; Status Code: 400; Error Code: BadRequestException

这太令人沮丧了，我已经仔细检查了OpenAPI文档以确保我的语法正确.任何帮助或提示将不胜感激！

It is super frustrating and I've double checked OpenAPI documentation to make sure my syntax is correct. Any help or tips would be most appreciated!

这是我拥有的Cloudformation模板:

Here is the Cloudformation template I have:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Data API pipeline initial Cloudformation template

Mappings:
  EnvironmentMapping:
    alpha:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    beta:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    prod:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: ABC
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
Parameters:
  EnvironmentType:
    Type: "String"
    AllowedValues:
      - alpha
      - beta
      - prod

Conditions:
  UseProdCondition: !Equals [!Ref EnvironmentType, prod]

Resources:
  MyApiVpcLink:
    Type: AWS::ApiGateway::VpcLink
    Properties:
      Name: MyApiVpcLink
      Description: Allows data-api-gateway to access the VPC that my-api is on.
      TargetArns:
        - !FindInMap [EnvironmentMapping, !Ref EnvironmentType, myApiNetworkLoadBalancer]

  DataApi:
    DependsOn:
      - MyApiVpcLink
    Type: AWS::Serverless::Api
    Properties:
      Name: !Sub "${EnvironmentType}-data-api"
      StageName: !Ref EnvironmentType
      DefinitionBody:
        swagger: 2.0
        security:
          - ApiKey: []
        info:
          title: !Sub "${EnvironmentType}-data-api"
        paths:
          /sfdc/v1/my-api/{proxy+}:
            x-amazon-apigateway-any-method:
              produces:
                - application/json
              parameters:
                - in: path
                  name: proxy
                  required: true
                  schema:
                    type: string
                - in: header
                  name: x-api-auth
                  required: true
                  schema:
                    type: string
              security:
                - SfdcAuthorizer: []
                  ApiKey: []
              x-amazon-apigateway-api-key-source: HEADER
              x-amazon-apigateway-gateway-responses:
                ACCESS_DENIED:
                  statusCode: 403
                  responseTemplates:
                    application/json: '{\n\"message\": \"Access Denied\"}'
              x-amazon-apigateway-integration:
                httpMethod: ANY
                type: http_proxy
                connectionType: VPC_LINK
                connectionId: !Ref MyApiVpcLink
                passthroughBehavior: when_no_match
                uri: !If [UseProdCondition, 'http://myapp.production.aws-int.myorg.io/{proxy}',!Sub 'http://${EnvironmentType}-myapp.staging.aws-int.myorg.io/{proxy}']
                requestParameters:
                  integration.request.path.proxy: "method.request.path.proxy"
                  # -------------------- this breaks it once added -------------------
                  integration.request.header.x-api-auth: "$context.authorizer.x-api-auth"
                  # ------------------------------------------------------------------
        definitions:
          Empty:
            type: object
          Error:
            type: object
            properties:
              message:
                type: string
        securityDefinitions:
          SfdcAuthorizer:
            type: 'apiKey'
            name: 'Authorization'
            in: 'header'
            x-amazon-apigateway-authtype: 'custom'
            x-amazon-apigateway-authorizer:
              authorizerUri: !Join ['', [!Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/', !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthLambda], '/invocations']]
              authorizerResultTtlInSeconds: !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthTimeout]
              type: 'token'
          ApiKey:
            type: apiKey
            name: x-api-key
            in: header

推荐答案

好吧……在不了解文档的情况下，我流氓并从"integration.request.header.x-api-"中删除了"$" auth" ...并且有效.不知道我对此有何看法.

Well... after getting nowhere with following the documentation, I went rogue and removed the "$" from "integration.request.header.x-api-auth"... AND THAT WORKED. Not sure how I feel about this.

这是完整的可用YAML文件.我将其张贴在此处，以防它有助于尝试建立采用PROXY路径并期望Lambda授权者返回的网关的其他人.

Here is the complete working YAML file. I'm posting it here in case it should help someone else who is trying to set up a gateway which takes PROXY path and expects a return from a Lambda authorizer.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Data API pipeline initial Cloudformation template

Mappings:
  EnvironmentMapping:
    alpha:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    beta:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    prod:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: ABC
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
Parameters:
  EnvironmentType:
    Type: "String"
    AllowedValues:
      - alpha
      - beta
      - prod

Conditions:
  UseProdCondition: !Equals [!Ref EnvironmentType, prod]

Resources:
  MyApiVpcLink:
    Type: AWS::ApiGateway::VpcLink
    Properties:
      Name: MYApiVpcLink
      Description: Allows data-api-gateway to access the VPC that feature-api is on.
      TargetArns:
        - !FindInMap [EnvironmentMapping, !Ref EnvironmentType, myApiNetworkLoadBalancer]

  DataApi:
    DependsOn:
      - MyApiVpcLink
    Type: AWS::Serverless::Api
    Properties:
      Name: !Sub "${EnvironmentType}-data-api"
      StageName: !Ref EnvironmentType
      DefinitionBody:
        swagger: 2.0
        security:
          - ApiKey: []
        info:
          title: !Sub "${EnvironmentType}-data-api"
        paths:
          /sfdc/v1/my-api/{proxy+}:
            x-amazon-apigateway-any-method:
              produces:
                - application/json
              parameters:
                - in: path
                  name: proxy
                  required: true
                  schema:
                    type: string
                - in: header
                  name: x-api-auth
                  required: true
                  schema:
                    type: string
              security:
                - SfdcAuthorizer: []
                  ApiKey: []
              x-amazon-apigateway-api-key-source: HEADER
              x-amazon-apigateway-gateway-responses:
                ACCESS_DENIED:
                  statusCode: 403
                  responseTemplates:
                    application/json: '{\n\"message\": \"Access Denied\"}'
              x-amazon-apigateway-integration:
                httpMethod: ANY
                type: http_proxy
                connectionType: VPC_LINK
                connectionId: !Ref MyApiVpcLink
                passthroughBehavior: when_no_match
                uri: !If [UseProdCondition, 'http://myapp.production.aws-int.myorg.io/{proxy}',!Sub 'http://${EnvironmentType}-myapp.staging.aws-int.myorg.io/{proxy}']
                requestParameters:
                  integration.request.path.proxy: "method.request.path.proxy"
                  integration.request.header.x-api-auth: "context.authorizer.x-api-auth"
        definitions:
          Empty:
            type: object
          Error:
            type: object
            properties:
              message:
                type: string
        securityDefinitions:
          SfdcAuthorizer:
            type: 'apiKey'
            name: 'Authorization'
            in: 'header'
            x-amazon-apigateway-authtype: 'custom'
            x-amazon-apigateway-authorizer:
              authorizerUri: !Join ['', [!Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/', !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthLambda], '/invocations']]
              authorizerResultTtlInSeconds: !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthTimeout]
              type: 'token'
          ApiKey:
            type: apiKey
            name: x-api-key
            in: header

这篇关于带有Lambda Authorizer的AWS API Gateway的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！