Question

我正在尝试使用cloudformation在API Gateway中部署API。这些方法需要启用CORS，我在此处Enable CORS for API Gateway in Cloudformation template遵循了模板。这是我的模板

AuthorizerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Action:
              - "sts:AssumeRole"
            Effect: "Allow"
            Principal:
              Service:
                - "apigateway.amazonaws.com"
      Policies:
        - PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Action:
                  - "lambda:invokeFunction"
                Effect: "Allow"
                Resource:
                  - !GetAtt "MyAPIAuthorizer.Arn"
          PolicyName: "lambda"

Authorizer:
  Type: AWS::ApiGateway::Authorizer
  Properties:
    AuthorizerResultTtlInSeconds: 0
    AuthorizerCredentials: !GetAtt "AuthorizerRole.Arn"
    AuthorizerUri:
      Fn::Join:
        - ""
        -
          - "arn:aws:apigateway:"
          - Ref: "AWS::Region"
          - ":lambda:path/2015-03-31/functions/"
          - Fn::GetAtt:
              - "MyAPIAuthorizer"
              - "Arn"
          - "/invocations"
    Type: "TOKEN"
    IdentitySource: "method.request.header.token"
    Name: "DefaultAuthorizer"
    RestApiId: !Ref RestApi

MyAPIAuthorizer:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: my-My-lambda-us-east-1
        S3Key: node_lambdas.zip
      Handler: My-APIAuthorizer.handler
      Role: !Ref Role
      Runtime: nodejs6.10
      Timeout: 300
      VpcConfig:
        SecurityGroupIds:
          - !Ref SecurityGroup
        SubnetIds: !Ref Subnets

MyAuthenticateUser:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: My-My-lambda-us-east-1
        S3Key: node_lambdas.zip
      Handler: My-AuthenticateUser.handler
      Role: !Ref Role
      Runtime: nodejs6.10
      Timeout: 300
      VpcConfig:
        SecurityGroupIds:
          - !Ref SecurityGroup
        SubnetIds: !Ref Subnets
      #Policies: AWSLambdaDynamoDBExecutionRole

MyAuthenticateUserApiGatewayInvoke:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt "MyAuthenticateUser.Arn"
      Principal: "apigateway.amazonaws.com"
      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/*/*"
MyAuthenticateUserResource:
     Type: AWS::ApiGateway::Resource
     Properties:
       RestApiId: !Ref RestApi
       ParentId: !Ref ApiResourceParent
       PathPart: authenticateuser
MyAuthenticateUserPost:
      Type: AWS::ApiGateway::Method
      Properties:
        RestApiId: !Ref RestApi
        ResourceId: !Ref MyAuthenticateUserResource
        HttpMethod: POST
        AuthorizationType: NONE
        Integration:
          IntegrationHttpMethod: POST
          Type: AWS
          Uri: !Sub
            - "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${lambdaArn}/invocations"
            - lambdaArn: !GetAtt "MyAuthenticateUser.Arn"
          IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
        MethodResponses:
        - StatusCode: 200
          ResponseModels:
            application/json: 'Empty'
          ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: true
MyAuthenticateUserOptions:
      Type: AWS::ApiGateway::Method
      Properties:
        RestApiId: !Ref RestApi
        ResourceId: !Ref MyAuthenticateUserResource
        HttpMethod: OPTIONS
        AuthorizationType: NONE
        Integration:
            IntegrationHttpMethod: POST
            IntegrationResponses:
            - StatusCode: 200
              ResponseParameters:
                method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,token'"
                method.response.header.Access-Control-Allow-Methods: "'POST,OPTIONS'"
                method.response.header.Access-Control-Allow-Origin: "'*'"
            Type: MOCK
        MethodResponses:
        - StatusCode: 200
          ResponseModels:
            application/json: 'Empty'
          ResponseParameters:
              method.response.header.Access-Control-Allow-Headers: true
              method.response.header.Access-Control-Allow-Methods: true
              method.response.header.Access-Control-Allow-Origin: true

MyFunction:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        S3Bucket: My-My-lambda-us-east-1
        S3Key: node_lambdas.zip
      Handler: My-Function.handler
      Role: !Ref Role
      Runtime: nodejs6.10
      Timeout: 300
      VpcConfig:
        SecurityGroupIds:
          - !Ref SecurityGroup
        SubnetIds: !Ref Subnets
      #Policies: AWSLambdaDynamoDBExecutionRole

MyFunctionApiGatewayInvoke:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt "MyFunction.Arn"
      Principal: "apigateway.amazonaws.com"
      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${RestApi}/*/*/*"
MyFunctionResource:
     Type: AWS::ApiGateway::Resource
     Properties:
       RestApiId: !Ref RestApi
       ParentId: !Ref ApiResourceParent
       PathPart: Function
MyFunctionGet:
      Type: AWS::ApiGateway::Method
      Properties:
        RestApiId: !Ref RestApi
        ResourceId: !Ref MyFunctionResource
        HttpMethod: GET
        AuthorizationType: CUSTOM
        AuthorizerId: !Ref Authorizer
        Integration:
          IntegrationHttpMethod: GET
          Type: AWS
          Uri: !Sub
            - "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${lambdaArn}/invocations"
            - lambdaArn: !GetAtt "MyFunction.Arn"
          IntegrationResponses:
          - StatusCode: 200
            ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: "'*'"
        MethodResponses:
        - StatusCode: 200
          ResponseModels:
            application/json: 'Empty'
          ResponseParameters:
              method.response.header.Access-Control-Allow-Origin: true
MyFunctionOptions:
      Type: AWS::ApiGateway::Method
      Properties:
        RestApiId: !Ref RestApi
        ResourceId: !Ref MyFunctionResource
        HttpMethod: OPTIONS
        AuthorizationType: NONE
        Integration:
            IntegrationHttpMethod: GET
            IntegrationResponses:
            - StatusCode: 200
              ResponseParameters:
                method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,token'"
                method.response.header.Access-Control-Allow-Methods: "'GET,OPTIONS'"
                method.response.header.Access-Control-Allow-Origin: "'*'"
            Type: MOCK
        MethodResponses:
        - StatusCode: 200
          ResponseModels:
            application/json: 'Empty'
          ResponseParameters:
              method.response.header.Access-Control-Allow-Headers: true
              method.response.header.Access-Control-Allow-Methods: true
              method.response.header.Access-Control-Allow-Origin: true

部署API后，MyAuthenticateUserPost方法将返回带有以下响应标头的200

访问控制允许来源→*

连接→保持活动

内容长度→249

内容类型→application / json

日期→星期五，2018年9月28日21:15:38 GMT

通过→1.1 sdlkfnsdlk.cloudfront.net（CloudFront）

X-Amz-Cf-Id→dflknsdlfkn

X-Amzn-Trace-Id→Root = sdlkfnsdlk; Sampled = 0

X-Cache→来自云端的失踪

x-amz-apigw-id→sdklfnsdlk

x-amzn-RequestId→slkfnlsdk

但是MyFunctionGet方法返回带有以下响应标头的500

连接→保持活动

内容长度→36

Content-Type→应用程序/ json

日期→星期五，2018年9月28日21:19:04 GMT

通过→1.1 slkdfnk.cloudfront.net（CloudFront）

X-Amz-Cf-Id→dsklfnsdlk

X-Cache→来自云端的错误

x-amz-apigw-id→dlsfknsdlkfn

x-amzn-RequestId→sdkfnsdkln

500响应缺少Access-Control-Allow-Origin和X-Amzn-Trace-Id标头。两种方法之间的区别在于，工作方法是POST且没有授权，而无效方法是GET并具有自定义授权者。如果进入API网关控制台，选择GET方法-> Integration Request，然后像这样保存Lambda函数，就可以使返回500的方法工作

在部署cloudformation后，该功能已经存在于该字段中，并且我已经在模板中添加了权限，但是除非执行此手动步骤，否则API Gateway方法将不起作用。我大约有50种方法，所以我想完全自动化。我在模板中丢失了什么吗？

更新：响应@jny，我像这样更新了Get方法中的集成响应

IntegrationResponses:
              - StatusCode: 200
                SelectionPattern: "2\\{d}2"
                ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: "'*'"
              - StatusCode: 300
                SelectionPattern: "3\\{d}2"
                ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: "'*'"
              - StatusCode: 400
                SelectionPattern: "4\\{d}2"
                ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: "'*'"
              - StatusCode: 500
                SelectionPattern: "5\\{d}2"
                ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: "'*'"
            MethodResponses:
            - StatusCode: 200
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: true
            - StatusCode: 300
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: true
            - StatusCode: 400
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: true
            - StatusCode: 500
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Origin: true

我也对我的选项方法进行了相同的更新

IntegrationResponses:
                - StatusCode: 200
                  SelectionPattern: "2\\{d}2"
                  ResponseParameters:
                    method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,token'"
                    method.response.header.Access-Control-Allow-Methods: "'GET,OPTIONS'"
                    method.response.header.Access-Control-Allow-Origin: "'*'"
                - StatusCode: 300
                  SelectionPattern: "3\\{d}2"
                  ResponseParameters:
                    method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,token'"
                    method.response.header.Access-Control-Allow-Methods: "'GET,OPTIONS'"
                    method.response.header.Access-Control-Allow-Origin: "'*'"
                - StatusCode: 400
                  SelectionPattern: "4\\{d}2"
                  ResponseParameters:
                    method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,token'"
                    method.response.header.Access-Control-Allow-Methods: "'GET,OPTIONS'"
                    method.response.header.Access-Control-Allow-Origin: "'*'"
                - StatusCode: 500
                  SelectionPattern: "5\\{d}2"
                  ResponseParameters:
                    method.response.header.Access-Control-Allow-Headers: "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,token'"
                    method.response.header.Access-Control-Allow-Methods: "'GET,OPTIONS'"
                    method.response.header.Access-Control-Allow-Origin: "'*'"
            MethodResponses:
            - StatusCode: 200
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Headers: false
                  method.response.header.Access-Control-Allow-Methods: false
                  method.response.header.Access-Control-Allow-Origin: false
            - StatusCode: 300
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Headers: false
                  method.response.header.Access-Control-Allow-Methods: false
                  method.response.header.Access-Control-Allow-Origin: false
            - StatusCode: 400
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Headers: false
                  method.response.header.Access-Control-Allow-Methods: false
                  method.response.header.Access-Control-Allow-Origin: false
            - StatusCode: 500
              ResponseModels:
                application/json: 'Empty'
              ResponseParameters:
                  method.response.header.Access-Control-Allow-Headers: false
                  method.response.header.Access-Control-Allow-Methods: false
                  method.response.header.Access-Control-Allow-Origin: false

调用API方法时，我仍然看到500响应

Answer 1

您必须为所有状态（而不只是200）配置ResponseParameters。

类似的东西：

   "IntegrationResponses": [
        {
          "ResponseParameters":{
            "method.response.header.Access-Control-Allow-Origin": "'*'"
          },
        "StatusCode": 200,
        "ResponseTemplates": {
        ....
        }
      },
        {
          "StatusCode": 500,
          "SelectionPattern": "5\\{d}2",
          "ResponseTemplates": {
              ....
          }
        }
      ],

，对于方法响应也是如此，例如：

"MethodResponses": [{
      "ResponseModels": {
        "application/json": "Empty"
      },
      "ResponseParameters":{
        "method.response.header.Access-Control-Allow-Origin": "'*'"
      },
      "StatusCode": "200"
    },
      {
        "StatusCode": "500"
      }
    ]

API网关Cloudformation CORS

1 个答案: