覆盖 SAM 模板和 Open API 中的默认身份验证答案

【问题标题】：Override default auth in SAM templates and Open API覆盖 SAM 模板和 Open API 中的默认身份验证
【发布时间】：2022-11-09 23:01:56
【问题描述】：

我制作了一个 SAM 模板，该模板混合了公共和经过身份验证的端点。默认身份验证为oauth。对于公共端点，我使用覆盖来使其验证NONE。这工作得很好。

在我为文档添加 OpenAPI 之后。公共端点的身份验证覆盖不再起作用。我还应该做什么？

#sam-template.yaml
Resources:
  RestApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: !Ref ApiStackName
      StageName: Prod
      Auth:
        AddDefaultAuthorizerToCorsPreflight: false
        DefaultAuthorizer: TokenAuthorizer
        Authorizers:
          TokenAuthorizer:
            FunctionArn: !GetAtt Authorizer.Arn
            Identity:
              Header: Authorization
              ValidationExpression: Bearer.*
              ReauthorizeEvery: 0
      DefinitionBody: // this is what I added.
        Fn::Transform:
          Name: AWS::Include
          Parameters:
            Location:
              Fn::Join:
                - ''
                - - 's3://'
                  - Ref: S3BucketName
                  - '/swagger.yaml'
  GetFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./functions
      FunctionName: !Sub ${Environment}-api-get
      Description: get 
      Handler: ./src/get.handler
      Role: !Sub arn:aws:iam::${AWS::AccountId}:role/pam-${Environment}-${AWS::Region}-get-lambda-role
      Events:
        Api:
          Type: Api
          Properties:
            RestApiId: !Ref RestApi
            Path: /p
            Method: GET
            Auth:
              Authorizer: NONE // this overrides the default auth

#swagger.yaml
  /p:
    get:
      summary: Get 
      description: Get 

      responses:
        200:
          description: "200 response"
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: "#/components/schemas/P"
        500:
          description: "500 response"
          content: {}
      x-amazon-apigateway-auth:
        type: "NONE"
      x-amazon-apigateway-integration:
        uri:
          Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${GetFunction.Arn}/invocations
        responses:
          default:
            statusCode: "200"
        passthroughBehavior: "when_no_match"
        httpMethod: "POST"
        contentHandling: "CONVERT_TO_TEXT"
        type: "aws_proxy"

【问题讨论】：

标签： amazon-web-services openapi aws-serverless

【解决方案1】：

您正在 OpenAPI 中寻找 security。这会将 ApiGateway 端点上的授权设置为 NONE。

/p:
  get:
    summary: Get 
    description: Get 
    responses:
      ...
    security:
      - {}
    x-amazon-apigateway-integration:
      ...

【讨论】：

【解决方案2】：

security: {}

或者

security: 
 - {}

没有为我工作。下面提到的代码 sn-p 工作。

security:
 - NONE: []

【讨论】：