Question

我已经使用无服务器框架创建了一组AWS Lambda，并使用了一个调用它们的React应用。已在AWS Cognito中设置了用户池和身份池，并在DynamoDB中设置了表。（我已遵循serverless-stack.com上的教程）。这是一个简单的笔记应用程序。

客户端应用程序已部署到：https://dev.cakebook.co

已部署API：https://api.cakebook.co/dev/orders

但是，在我使用此Cognito用户登录后：

admin@example.com Passw0rd！

对于订单GET，我收到403响应：

message: “User: arn:aws:sts::********8766:assumed-role/cakebook-api-dev-CognitoAuthRole-1DTRT5XGEGRXW/CognitoIdentityCredentials is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-2:********8766:sss6l7svxc/dev/GET/orders”

我对这一切还是陌生的，但是我的Cognito用户似乎没有调用Lambda（或API网关？）的权限。那是问题吗？如果是这样，我如何授予用户调用Lambda的权限？

更新，请求JSON

执行角色：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "logs:CreateLogStream"
            ],
            "Resource": [
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-create:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-get:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-list:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-update:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-delete:*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-create:*:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-get:*:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-list:*:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-update:*:*",
                "arn:aws:logs:us-east-2:********8766:log-group:/aws/lambda/cakebook-api-dev-delete:*:*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "dynamodb:DescribeTable",
                "dynamodb:Query",
                "dynamodb:Scan",
                "dynamodb:GetItem",
                "dynamodb:PutItem",
                "dynamodb:UpdateItem",
                "dynamodb:DeleteItem"
            ],
            "Resource": [
                "arn:aws:dynamodb:us-east-2:********8766:table/orders"
            ],
            "Effect": "Allow"
        },
        {
            "Sid": "1",
            "Effect": "Allow",
            "Action": "lambda:InvokeFunction",
            "Resource": "arn:aws:lambda:us-east-2:********8766:function:cakebook-api-dev-list",
            "Condition": {
                "ArnLike": {
                    "AWS:SourceArn": "arn:aws:cognito-identity:us-east-2:********8766:identitypool/us-east-2:d9e4e505-c64a-4836-8e56-3af843dbe453"
                }
            }
        }
    ]
}

功能策略：

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "cakebook-api-dev-ListLambdaPermissionApiGateway-U7OCBI3JM44G",
      "Effect": "Allow",
      "Principal": {
        "Service": "apigateway.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-east-2:********8766:function:cakebook-api-dev-list",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:execute-api:us-east-2:********8766:w5o4vxx4f0/*/*"
        }
      }
    },
    {
      "Sid": "lambda-da48f6d0-6d3c-4bbf-a761-ca3510f79624",
      "Effect": "Allow",
      "Principal": {
        "Service": "cognito-sync.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:us-east-2:********8766:function:cakebook-api-dev-list",
      "Condition": {
        "ArnLike": {
          "AWS:SourceArn": "arn:aws:cognito-identity:us-east-2:********8766:identitypool/us-east-2:d9e4e505-c64a-4836-8e56-3af843dbe453"
        }
      }
    }
  ]
}

Answer 1

您需要更新Lambda权限，以允许Cognito用户池调用。

选项A-JSON格式的更新权限

{
  "Version": "2012-10-17",
  "Id": "default",
  "Statement": [
    {
      "Sid": "lambda-something",
      "Effect": "Allow",
      "Principal": {
        "Service": "cognito-sync.amazonaws.com"
      },
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:eu-west-1:__accountId__:__function_name__",
      "Condition": {
        "ArnLike": {
           "AWS:SourceArn": "arn:aws:cognito-identity:eu-west-1:__accountId__:identitypool/eu-west-1:....."
        }
      }
    }
  ]
}

选项B-在控制台中

转到Lambda配置页面
添加触发器Cognito同步触发器
保存期间，它将自动配置Lambda权限-同意

AWS Cognito用户无法调用Lambda（403未授权）

1 个答案: