【发布时间】：2020-10-07 00:05:11
【问题描述】：
我已经设法通过带有 OpenAPI 定义的 yaml SAM 模板部署了具有不同路由和 lambda 集成的 AWS HTTP API，但我坚持将自定义 lambda 授权程序添加到我的路由中。当我部署堆栈时，API 创建超时：
ROLLBACK_IN_PROGRESS AWS::CloudFormation::Stack CloudArYer The following resource(s) failed to
create: [Api]. . Rollback requested by
user.
CREATE_FAILED AWS::ApiGatewayV2::Api Api Internal server error (Service:
AmazonApiGatewayV2; Status Code: 500;
Error Code: InternalServerException;
Request ID: 18242cfd-
cc94-4909-a26a-6631806f94e7; Proxy:
null)
这是我的模板的主要部分，其中包含 API 定义：
...
AuthorizerLambdaTemplate:
Type: AWS::Serverless::Application
Properties:
Location: ./templates/Authorizer-template-function.yaml
Parameters:
ProjectName: !Sub "${ProjectName}"
ProjectApiKey: !Sub "${ProjectApiKey}"
Api:
Type: AWS::Serverless::HttpApi
Properties:
StageName: CloudArYerAPI
CorsConfiguration:
AllowCredentials: true
AllowHeaders: "*"
AllowMethods:
- GET
- POST
- PUT
AllowOrigins:
- https://*
DefinitionBody:
openapi: 3.0.1
info:
title: CoudArYer-API
description: HTTP API for connected chicken coop (Cloud Ar Yer)
version: 2020-09-26
paths:
/config/{device}:
get:
x-amazon-apigateway-integration:
$ref: "#/components/x-amazon-apigateway-integrations/GETLambda"
/event/{type}:
post:
x-amazon-apigateway-integration:
$ref: "#/components/x-amazon-apigateway-integrations/POSTLambda"
/image/{origin}/{device}:
put:
x-amazon-apigateway-integration:
$ref: "#/components/x-amazon-apigateway-integrations/PUTLambda"
security:
- CloudArYer-Authorizer: []
components:
securitySchemes:
CloudArYer-Authorizer:
type: apiKey
name: authorization
in: header
x-amazon-apigateway-authtype: custom
x-amazon-apigateway-authorizer:
type: request
identitySource: $request.header.authorization
authorizerUri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${AuthorizerLambdaTemplate.Outputs.FunctionArn}/invocations
authorizerCredentials: !GetAtt ApiGatewayAuthorizerRole.Arn
authorizerPayloadFormatVersion: "2.0"
authorizerResultTtlInSeconds: 60
enableSimpleResponses: true
x-amazon-apigateway-integrations:
PUTLambda:
payloadFormatVersion: "2.0"
type: "aws_proxy"
httpMethod: "POST"
uri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${PUTImageLambdaTemplate.Outputs.FunctionArn}/invocations
connectionType: "INTERNET"
GETLambda:
payloadFormatVersion: "2.0"
type: "aws_proxy"
httpMethod: "POST"
uri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${GETConfigLambdaTemplate.Outputs.FunctionArn}/invocations
connectionType: "INTERNET"
POSTLambda:
payloadFormatVersion: "2.0"
type: "aws_proxy"
httpMethod: "POST"
uri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${POSTEventLambdaTemplate.Outputs.FunctionArn}/invocations
connectionType: "INTERNET"
ApiGatewayAuthorizerRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service:
- "apigateway.amazonaws.com"
Action:
- sts:AssumeRole
Policies:
- PolicyName: "InvokeAuthorizerFunction"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Action:
- lambda:InvokeAsync
- lambda:InvokeFunction
Resource: !GetAtt AuthorizerLambdaTemplate.Outputs.FunctionArn
...
我的授权 lambda 是在嵌套堆栈中定义的 (AuthorizerLambdaTemplate)
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
AuthorizerFunction:
Type: AWS::Serverless::Function
Properties:
FunctionName: !Sub "${ProjectName}-Authorizer-Lambda"
CodeUri: ../src/authorizer
Handler: handler.authorizer
Runtime: nodejs10.x
Role: !Sub "${CustomAuthorizerFunctionRole.Arn}"
Environment:
Variables:
ProjectApiKey: !Sub "${ProjectApiKey}"
CustomAuthorizerFunctionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Service:
- "lambda.amazonaws.com"
Action:
- sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
Parameters:
ProjectName:
Type: String
ProjectApiKey:
Type: String
Outputs:
FunctionArn:
Description: Arn Authorizer function
Value: !GetAtt AuthorizerFunction.Arn
并且 lambda 的代码在外部目录中定义如下
exports.authorizer = async(event) => {
let response = {
"isAuthorized": false,
"context": {
"stringKey": "test"
}
};
if (event.headers.authorization === process.env.ProjectApiKey) {
response = {
"isAuthorized": true,
"context": {
"stringKey": "test"
}
};
}
return response;
};
我不明白为什么在创建 API 时部署被阻止...并且因 InternalServerException 而失败。我在堆栈定义上哪里错了。我浏览了许多网站，sn-ps...但新 HTTP API 的信息较少，例如没有解决我的问题的线索。
感谢您的潜在帮助！ :-)
【问题讨论】：
标签： amazon-web-services aws-lambda authorization amazon-cloudformation openapi