Question

我想从API网关端点访问S3存储桶中的文件。

我已使用以下密钥将文件上传到S3存储桶：path//filename.txt（请注意，空子文件夹名称是有意的）

但是，当我发出以下HTTP请求时：

curl -X GET 'https://api.cloud/v1/files/filename.txt'

集成失败，并返回XML错误。 API网关的日志状态：

Received response. Status: 403, Integration latency: 8 ms

Endpoint response body before transformations:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>SignatureDoesNotMatch</Code>
    <Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>
    ...
</Error>

我无法为自己的一生弄清楚我的缺失。

我是否不允许将API网关集成到密钥中包含空文件夹的S3对象？

我已经使用CloudFormation部署了S3存储桶，以下是一些相关的内容：

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  MyBucket:
    Type: 'AWS::S3::Bucket'
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      CorsConfiguration:
        CorsRules:
        - AllowedHeaders: ['*']
          AllowedMethods: [GET,PUT]
          AllowedOrigins: ['*']
          ExposedHeaders: [Date]
          Id: CORSRules
          MaxAge: 3600

  BucketReadRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - apigateway.amazonaws.com
            Action: 'sts:AssumeRole'
      Policies:
        - PolicyName: bucket-read
          PolicyDocument:
            Version: 2012-10-17
            Statement:
            - Effect: Allow
              Action:
                - 's3:GetObject'
              Resource: !Join
                - '/'
                - - !GetAtt MyBucket.Arn
                  - '*'

我已使用以下集成配置了API网关（请注意%2F以说明空的子文件夹名称）：

paths:
  /files/{filename}:
    get:
      parameters:
      - in: path
        name: filename
        required: true
        schema:
          type: string
      x-amazon-apigateway-integration:
        credentials:
          Fn::Sub: ${BucketReadRole.Arn}
        uri:
          Fn::Sub:
            - arn:${AWS::Partition}:apigateway:${AWS::Region}:s3:path/${MyBucket}/path/%2F{filename}
            - MyBucket:
                Fn::ImportValue: MyBucket
        responses:
          default:
            statusCode: "200"
            responseParameters:
              method.response.header.Content-Length: "integration.response.header.Content-Length"
              method.response.header.Content-Type: "integration.response.header.Content-Type"
              method.response.header.ETag: "integration.response.header.ETag"
        requestParameters:
          integration.request.path.filename: "method.request.path.filename"
        passthroughBehavior: "when_no_match"
        httpMethod: "GET"
        type: "aws"

API Gateway S3集成签名与空白文件夹名称不匹配

0 个答案: