Question

我想拒绝对 AWS API 网关的公开访问，并且仅在使用特定角色调用 API 时才允许访问。在我的测试中有两个网关，一个调用另一个：

Public Gateway -> Private Gateway

我希望能够在浏览器中访问公共网关端点并收到 2XX 响应，当直接访问私有网关时，我应该收到 4XX 响应。访问私有网关的唯一方法应该是通过公共网关（它通过每个端点代理到私有网关）。

我尝试了多种策略。所有这些总是导致公共网关错误日志显示以下内容：

<块引用>

用户：匿名无权执行：execute-api:Invoke on resource: arn:aws:execute-api:us-east-1:********9012:abcd123456/dev/GET/产品

公共网关收到该错误消息作为来自私有网关的响应。

以下是我尝试过的政策（单独）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::123456789012:role/test-apigateway-role"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::123456789012:role/test-apigateway-role",
                    "arn:aws:iam::123456789012:root"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*/*/*",
            "Condition": {
                "ArnNotEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::123456789012:role/test-apigateway-role"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*/*/*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::123456789012:role/test-apigateway-role"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*/*/*"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::123456789012:role/test-apigateway-role"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*/*/*",
            "Condition": {
                "StringEquals": {
                    "aws:PrincipalArn": "arn:aws:iam::123456789012:role/test-apigateway-role"
                }
            }
        }
    ]
}

我重新部署了每个资源策略更改，并在测试前等待了一分钟。

在公共网关的 serverless.yml 设置中分配角色：

service: test-gateway

provider:
  name: aws
  runtime: nodejs12.x
  apiGateway:
    shouldStartNameWithService: true
  role: arn:aws:iam::123456789012:role/test-apigateway-role

Answer 1

试试这个怎么样？

根据the docs，如果您不指定明确的Deny，然后提供特定的Allow，它应该可以工作。如果没有，请继续分享您的输出，我很感兴趣。

更新：我删除了拒绝 * 部分，这意味着对于未在 Allow 语句中明确声明的请求，我们将获得隐式拒绝。这是根据会话政策（见文档链接）

更新 2：查看此答案的评论，作者还提到 - 将 authorizer: aws_iam 添加到 serverless.yml

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::123456789012:role/test-apigateway-role"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": [
                "arn:aws:execute-api:us-east-1:123456789012:abcd123456/*"
            ]
        }
    ]
}

如何拒绝对 AWS API 网关的公开访问，同时仅允许特定角色访问？

1 个答案: