无法为 AWS API Gateway 配置 Firebase 授权答案

【问题标题】：Unable to configure Firebase authorization to AWS API Gateway无法为 AWS API Gateway 配置 Firebase 授权
【发布时间】：2021-09-03 00:27:49
【问题描述】：

我正在使用AWS Lambda 和API Gateway 开发一个REST API。我正在尝试为此配置 Firebase 授权。仅供参考，我没有接触过 AWS Web 控制台，只是想用aws-sam 做所有事情。

下面是我的代码。我没有更改以下任何内容，代码按原样粘贴。

template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aws-restapi

  Sample SAM Template for aws-restapi
  
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 5
    VpcConfig:
        SecurityGroupIds:
          - sg-041f2459dcd921e8e
        SubnetIds:
          - subnet-038025dd
          - subnet-c44254cb

Parameters:
  FirebaseProjectId: 
    Type: String

Resources:

  AuthGatewayHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Auth:
        Authorizers:
          FirebaseAuthorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              audience:
                - !Ref aws-7e5db
              issuer: !Sub https://securetoken.google.com/${aws-7e5db}
        DefaultAuthorizer: FirebaseAuthorizer
      StageName: "Prod"
  
  AuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: aws-restapi/
      Handler: source/testfile.lambdaHandler
      Runtime: nodejs14.x
      Events:
        Gateway:
          Type: HttpApi
          Properties:
            ApiId: !Ref AuthGatewayHttpApi
            Path: /hello
            Method: GET

testfile.js

exports.lambdaHandler = async (event) => {
    try {
      // If an authenticated request is made to JWT
      // Which we expect is what will happen
      // So we simply return the claims
      const jwt = event.requestContext.authorizer.jwt.claims;
  
      // Let us get the email from the claims
      // Note the email will not be available if Sign in via phone
      const email = jwt.claims.email;
  
      return {
        statusCode: 200,
        body: JSON.stringify({ jwt: jwt, email: email }),
      };
    } catch (err) {
      console.error(err);
      return {
        statusCode: 400,
        body: JSON.stringify({ error: "Please check logs" }),
      };
    }
  };

这会构建，但无法部署。它只是抛出以下错误。

Error: Failed to create changeset for the stack: aws-restapi, An error occurred (ValidationError) when calling the CreateChangeSet operation: Parameters: [FirebaseProjectId] must have values

这里有什么问题？另外，我的 Firebase 身份验证配置是否正确？

【问题讨论】：

标签： amazon-web-services firebase aws-lambda aws-api-gateway aws-sam

【解决方案1】：

您正在定义一个参数，但没有为其赋值。

Parameters:
  FirebaseProjectId: 
    Type: String

要么删除它，要么赋值

【讨论】：

我尝试删除它。然后它给了我错误Error: Failed to create changeset for the stack: aws-restapi, ex: Waiter ChangeSetCreateComplete failed: Waiter encountered a terminal failure state: For expression "Status" we matched expected path: "FAILED" Status: FAILED. Reason: Template error: variable names in Fn::Sub syntax must contain only alphanumeric characters, underscores, periods, and colons
我真的不知道怎么给参数赋值
这是一个不同的错误。现在的问题是 ${aws-7e5db}。您不能在变量中使用连字符。
我找到了如何输入参数。
罗伯特，你能帮帮我吗？ - stackoverflow.com/questions/69049471/…

【解决方案2】：

您也可以通过提供默认值来避免此问题：

Parameters:
  FirebaseProjectId: 
    Type: String
    Default: "1111-2222-3333-44444"

【讨论】：

你能帮我吗？ - stackoverflow.com/questions/69043426/…

【解决方案3】：

我发现了这个问题。我必须传递参数。应在部署时传递参数。执行以下操作。

sam deploy --guided

然后按照流程，它会询问您的参数值。无论您之前是否进行过部署，都必须这样做。

然后，我的代码也错了。应该是这样的。

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aws-restapi

  Sample SAM Template for aws-restapi
  
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 5
    VpcConfig:
        SecurityGroupIds:
          - sg-041f2459dcd921e8e
        SubnetIds:
          - subnet-0381asa2d
          - subnet-c4dasascb


Parameters:
  FirebaseProjectId:
    Type: String

Resources:
  AuthGatewayHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Auth:
        Authorizers:
          FirebaseAuthorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              audience:
                - !Ref FirebaseProjectId
              issuer: !Sub https://securetoken.google.com/${FirebaseProjectId}
        DefaultAuthorizer: FirebaseAuthorizer
  
  AuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: peresia-restapi/
      Handler: source/testfile.lambdaHandler
      Runtime: nodejs14.x
      Events:
        Gateway:
          Type: HttpApi
          Properties:
            ApiId: !Ref AuthGatewayHttpApi
            Path: /hello
            Method: get

【讨论】：