如何解决未调用 API Gateway Authoriser
Description: >
This template deploys an Api gateway.
Parameters:
EnvironmentName:
Description: An environment name that will be prefixed to resource names
Type: String
VPCLink:
Description: vpc link for integration
Type: String
LoadBalancerListnerArn:
Description: private endpoint
Type: String
Resources:
HTTPApi:
Type: AWS::ApiGatewayV2::Api
Properties:
Name: !Ref EnvironmentName
ProtocolType: HTTP
LoadBalancerIntegration:
Type: AWS::ApiGatewayV2::Integration
Properties:
ApiId: !Ref HTTPApi
ConnectionType : VPC_LINK
ConnectionId: !Ref VPCLink
IntegrationType: HTTP_PROXY
IntegrationMethod: ANY
IntegrationUri: !Ref LoadBalancerListnerArn
PayloadFormatVersion: 1.0
FunctionExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service: [lambda.amazonaws.com]
Action: ['sts:AssumeRole']
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
AuthorizerFunction:
Type: AWS::Lambda::Function
Properties:
Handler: index.handler
Role : !GetAtt FunctionExecutionRole.Arn
Runtime: nodejs12.x
Code:
ZipFile: !Sub |
exports.handler = function(event,context,callback) {
callback("Hello");
}
FunctionInvokeRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service: [apigateway.amazonaws.com]
Action: ['sts:AssumeRole']
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess
Authorizer:
Type: AWS::ApiGatewayV2::Authorizer
Properties:
Name: !Sub ${EnvironmentName}-GateWayAuthorizer
ApiId: !Ref HTTPApi
AuthorizerCredentialsArn: !GetAtt FunctionInvokeRole.Arn
AuthorizerPayloadFormatVersion: 2.0
AuthorizerType: REQUEST
AuthorizerUri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${AuthorizerFunction.Arn}/invocations"
AuthorizerResultTtlInSeconds: 500
EnableSimpleResponses: true
IdentitySource:
- $request.header.Authorization
Route:
Type: AWS::ApiGatewayV2::Route
Properties:
ApiId: !Ref HTTPApi
RouteKey: '$default'
AuthorizationType: CUSTOM
AuthorizerId: !Ref Authorizer
Target: !Join
- /
- - integrations
- !Ref LoadBalancerIntegration
CloudWatchLogsGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: !Ref AWS::StackName
RetentionInDays: 365
Stage:
Type: AWS::ApiGatewayV2::Stage
Properties:
ApiId: !Ref HTTPApi
AutoDeploy: true
StageName: '$default'
AccessLogSettings:
DestinationArn: !GetAtt CloudWatchLogsGroup.Arn
Format: >-
{ "requestId":"$context.requestId","ip": "$context.identity.sourceIp","requestTime":"$context.requestTime","httpMethod":"$context.httpMethod","routeKey":"$context.routeKey","status":"$context.status","protocol":"$context.protocol","responseLength":"$context.responseLength","authorizerError" : " $context.authorizer.error" }
FunctionPermission:
Type: AWS::Lambda::Permission
Properties:
FunctionName: !GetAtt AuthorizerFunction.Arn
Action: lambda:InvokeFunction
Principal: apigateway.amazonaws.com
SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${HTTPApi}/$default/$default"
Outputs:
InvokeURL:
Value: !Sub https://${HTTPApi}.execute-api.${AWS::Region}.amazonaws.com
我正在尝试将 API 网关附加到私有 ALB,所有这些都可以正常工作。但是为路由附加授权后,api总是以401结尾。授权者Lambda函数没有被调用,API网关访问日志的云监视日志没有显示任何错误。
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。