Question

如何最好地通过IP限制对AWS API网关中某些路由的访问？我只想允许我的ECS集群访问API网关中的某些路由。我尝试将ECS NAT网关（VPC CIDR范围）放在aws:SourceIp中，但始终被拒绝。我什至尝试了我的个人计算机的公共IP地址...相同的结果...这是正确的方法吗？还是应该尝试IAM授权者？ IAM授权者的缺点是我需要签署我的API调用吗？也许使用API Gateway SDK？这意味着我希望避免代码更改。

{
  "Id": "MY_API_POLICY",
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": ["XX.XX.XX.XX/32"]
        }
      },
      "Resource": [
        "arn:aws:execute-*:*:apiid/stagename/*/private/route"
      ]
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": [
        "arn:aws:execute-*:*:apiid/stagename/*/public/route"
      ]
    }
  ]
}

Answer 1

正如@Visal已经提到的，限制ip /范围是正确的方法。这是示例：https://aws.amazon.com/de/blogs/compute/control-access-to-your-apis-using-amazon-api-gateway-resource-policies/

有一个允许访问特定IP范围的策略的示例：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::<account_idA>:user/<user>",
                    "arn:aws:iam::<account_idA>:root"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*/*/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": " 203.0.113.0/24"
                }
            }
        }
    ]
}

或者，如果您想拒绝访问，则可以找到以下政策：

{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "execute-api:Invoke",
    "Resource": "arn:aws:execute-api:us-east-1:<account_idB>:qxz8y9c8a4/*",
    "Condition": {
        "IpAddress": {
            "aws:SourceIp": "203.0.113.0/24"
        }
    }
}

如何仅允许IP /范围访问AWS API Gateway资源

1 个答案: