带有Lambda Authorizer的AWS API Gateway

时间：2019-10-28 19:55:18

标签： aws-api-gateway swagger-2.0 openapi lambda-authorizer

我正在尝试配置一个API网关，该网关从请求路径中获取代理参数，并从Lambda授权者返回的参数中并将其放在标头中，以便可以将其传递给运行的Elastic Beanstalk REST API春季启动。

代理路径按预期运行；而且我看到Lambda函数根据文档在“上下文”映射中返回变量“ x-api-auth”。

唯一不起作用的是在请求标头中添加“ x-api-auth”。 :(每当我运行我的Jenkins构建以更新Cloudformation堆栈时，都会出现此错误：

Errors found during import: Unable to put integration on 'ANY' for resource at path '/sfdc/v1/feature-api/{proxy+}': Invalid mapping expression specified: Validation Result: warnings : [], errors : [Invalid mapping expression specified: $context.authorizer.x-api-auth] (Service: AmazonApiGateway; Status Code: 400; Error Code: BadRequestException

这太令人沮丧了，我已经仔细检查了OpenAPI文档以确保我的语法正确。任何帮助或提示将不胜感激！

这是我拥有的Cloudformation模板：

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Data API pipeline initial Cloudformation template

Mappings:
  EnvironmentMapping:
    alpha:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    beta:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    prod:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: ABC
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
Parameters:
  EnvironmentType:
    Type: "String"
    AllowedValues:
      - alpha
      - beta
      - prod

Conditions:
  UseProdCondition: !Equals [!Ref EnvironmentType, prod]

Resources:
  MyApiVpcLink:
    Type: AWS::ApiGateway::VpcLink
    Properties:
      Name: MyApiVpcLink
      Description: Allows data-api-gateway to access the VPC that my-api is on.
      TargetArns:
        - !FindInMap [EnvironmentMapping, !Ref EnvironmentType, myApiNetworkLoadBalancer]

  DataApi:
    DependsOn:
      - MyApiVpcLink
    Type: AWS::Serverless::Api
    Properties:
      Name: !Sub "${EnvironmentType}-data-api"
      StageName: !Ref EnvironmentType
      DefinitionBody:
        swagger: 2.0
        security:
          - ApiKey: []
        info:
          title: !Sub "${EnvironmentType}-data-api"
        paths:
          /sfdc/v1/my-api/{proxy+}:
            x-amazon-apigateway-any-method:
              produces:
                - application/json
              parameters:
                - in: path
                  name: proxy
                  required: true
                  schema:
                    type: string
                - in: header
                  name: x-api-auth
                  required: true
                  schema:
                    type: string
              security:
                - SfdcAuthorizer: []
                  ApiKey: []
              x-amazon-apigateway-api-key-source: HEADER
              x-amazon-apigateway-gateway-responses:
                ACCESS_DENIED:
                  statusCode: 403
                  responseTemplates:
                    application/json: '{\n\"message\": \"Access Denied\"}'
              x-amazon-apigateway-integration:
                httpMethod: ANY
                type: http_proxy
                connectionType: VPC_LINK
                connectionId: !Ref MyApiVpcLink
                passthroughBehavior: when_no_match
                uri: !If [UseProdCondition, 'http://myapp.production.aws-int.myorg.io/{proxy}',!Sub 'http://${EnvironmentType}-myapp.staging.aws-int.myorg.io/{proxy}']
                requestParameters:
                  integration.request.path.proxy: "method.request.path.proxy"
                  # -------------------- this breaks it once added -------------------
                  integration.request.header.x-api-auth: "$context.authorizer.x-api-auth"
                  # ------------------------------------------------------------------
        definitions:
          Empty:
            type: object
          Error:
            type: object
            properties:
              message:
                type: string
        securityDefinitions:
          SfdcAuthorizer:
            type: 'apiKey'
            name: 'Authorization'
            in: 'header'
            x-amazon-apigateway-authtype: 'custom'
            x-amazon-apigateway-authorizer:
              authorizerUri: !Join ['', [!Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/', !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthLambda], '/invocations']]
              authorizerResultTtlInSeconds: !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthTimeout]
              type: 'token'
          ApiKey:
            type: apiKey
            name: x-api-key
            in: header

1 个答案:

答案 0 :(得分：0)

好吧。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。不知道我对此感觉如何。

这是完整的可用YAML文件。我将其张贴在这里，以防它有助于尝试建立采用PROXY路径并期望Lambda授权者返回的网关的其他人。

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Data API pipeline initial Cloudformation template

Mappings:
  EnvironmentMapping:
    alpha:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    beta:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: XYZ
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
    prod:
      certificationArn: ""
      carfaxIpWhitelistRuleId: ""
      hostedZoneId: ABC
      authLambda: ""
      sfdcAuthLambda: ""
      myApiNetworkLoadBalancer: ""
      sfdcAuthTimeout: 1
Parameters:
  EnvironmentType:
    Type: "String"
    AllowedValues:
      - alpha
      - beta
      - prod

Conditions:
  UseProdCondition: !Equals [!Ref EnvironmentType, prod]

Resources:
  MyApiVpcLink:
    Type: AWS::ApiGateway::VpcLink
    Properties:
      Name: MYApiVpcLink
      Description: Allows data-api-gateway to access the VPC that feature-api is on.
      TargetArns:
        - !FindInMap [EnvironmentMapping, !Ref EnvironmentType, myApiNetworkLoadBalancer]

  DataApi:
    DependsOn:
      - MyApiVpcLink
    Type: AWS::Serverless::Api
    Properties:
      Name: !Sub "${EnvironmentType}-data-api"
      StageName: !Ref EnvironmentType
      DefinitionBody:
        swagger: 2.0
        security:
          - ApiKey: []
        info:
          title: !Sub "${EnvironmentType}-data-api"
        paths:
          /sfdc/v1/my-api/{proxy+}:
            x-amazon-apigateway-any-method:
              produces:
                - application/json
              parameters:
                - in: path
                  name: proxy
                  required: true
                  schema:
                    type: string
                - in: header
                  name: x-api-auth
                  required: true
                  schema:
                    type: string
              security:
                - SfdcAuthorizer: []
                  ApiKey: []
              x-amazon-apigateway-api-key-source: HEADER
              x-amazon-apigateway-gateway-responses:
                ACCESS_DENIED:
                  statusCode: 403
                  responseTemplates:
                    application/json: '{\n\"message\": \"Access Denied\"}'
              x-amazon-apigateway-integration:
                httpMethod: ANY
                type: http_proxy
                connectionType: VPC_LINK
                connectionId: !Ref MyApiVpcLink
                passthroughBehavior: when_no_match
                uri: !If [UseProdCondition, 'http://myapp.production.aws-int.myorg.io/{proxy}',!Sub 'http://${EnvironmentType}-myapp.staging.aws-int.myorg.io/{proxy}']
                requestParameters:
                  integration.request.path.proxy: "method.request.path.proxy"
                  integration.request.header.x-api-auth: "context.authorizer.x-api-auth"
        definitions:
          Empty:
            type: object
          Error:
            type: object
            properties:
              message:
                type: string
        securityDefinitions:
          SfdcAuthorizer:
            type: 'apiKey'
            name: 'Authorization'
            in: 'header'
            x-amazon-apigateway-authtype: 'custom'
            x-amazon-apigateway-authorizer:
              authorizerUri: !Join ['', [!Sub 'arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/', !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthLambda], '/invocations']]
              authorizerResultTtlInSeconds: !FindInMap [EnvironmentMapping, !Ref EnvironmentType, sfdcAuthTimeout]
              type: 'token'
          ApiKey:
            type: apiKey
            name: x-api-key
            in: header
相关问题
最新问题