时间戳

首页 > 解决方案 > AWS CDK - 将 Cognito 用户池绑定到 API Gateway

amazon-web-services - AWS CDK - 将 Cognito 用户池绑定到 API Gateway

问题描述

我正在尝试使用 AWS CDK 设置一个非常基本的基础设施，其中包括

问题：我不知道如何正确创建授权者，所以它被 API GW 接受

合成 CF 模板工作正常，但在部署过程中出现以下错误：

Invalid authorizer ID specified. Setting the authorization type to CUSTOM or COGNITO_USER_POOLS requires a valid authorizer.

所以，我的授权人似乎不够合适，即使授权人本身的创建在部署期间被标记为成功。

有任何想法吗？

这是我在代码中的内容：

from aws_cdk import (
    core,
    aws_lambda,
    aws_apigateway,
    aws_cognito
)


class PlayGroundStack(core.Stack):

    def __init__(self, scope: core.Construct, id: str, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

        # Basic lamdba setup
        my_lambda = aws_lambda.Function(
            scope=self,
            id="lambda-1",
            runtime=aws_lambda.Runtime.PYTHON_3_6,
            code=aws_lambda.Code.asset('lambda'),
            handler='hello.handler'
        )

        # Few MethodOptions for the API GW
        my_get_operation = aws_apigateway.MethodOptions(operation_name="GET")
        my_post_operation = aws_apigateway.MethodOptions(operation_name="POST")

        # The API itself
        rest_api = aws_apigateway.LambdaRestApi(
            scope=self,
            id="rest-api-1",
            handler=my_lambda,
            proxy=False,
            default_method_options=my_get_operation
        )

        # User Pool used for auth
        api_userpool = aws_cognito.UserPool(
            scope=self,
            id="user-pool-1",
            sign_in_type=aws_cognito.SignInType.EMAIL
        )

        # The authorizer that should be attached to API GW
        my_cfn_authorizer = aws_apigateway.CfnAuthorizer(
            id='api_authorizer_cfn',
            rest_api_id=rest_api.rest_api_id,
            name='api_authorizer_cfn_name',
            scope=self,
            type='COGNITO_USER_POOLS',
            identity_source='method.request.header.Authorization',
            provider_arns=[api_userpool.user_pool_arn]
        )

        # Set methods for root node
        rest_api.root.add_method(my_get_operation.operation_name)
        rest_api.root.add_method(my_post_operation.operation_name)

        # Create a resource
        my_resource = rest_api.root.add_resource("my_sub_url")
        # And attach the Authorizer
        # This is where I get the error
        my_resource.add_method(http_method="GET",
                               authorization_type=aws_apigateway.AuthorizationType.COGNITO,
                               authorizer=my_cfn_authorizer)

标签： amazon-web-servicesaws-api-gatewayamazon-cognitoaws-cdk

解决方案

我想到了。你需要设置

authorization_type = my_cfn_authorizer.auth_type

这解决了一切。如果他们能在文档中告诉我们这样做会好得多，但是 python 文档很少。


class PlayGroundStack(core.Stack):

        ...

        # The authorizer that should be attached to API GW
        my_cfn_authorizer = aws_apigateway.CfnAuthorizer(
            id='api_authorizer_cfn',
            rest_api_id=rest_api.rest_api_id,
            name='api_authorizer_cfn_name',
            scope=self,
            type='COGNITO_USER_POOLS',
            identity_source='method.request.header.Authorization',
            provider_arns=[api_userpool.user_pool_arn]
        )

        # Set methods for root node
        rest_api.root.add_method(my_get_operation.operation_name)
        rest_api.root.add_method(my_post_operation.operation_name)

        my_resource = rest_api.root.add_resource("my_sub_url")
        # FIX HERE!!!!!!!
        my_resource.add_method(http_method="GET",
                               authorization_type=my_cfn_authorizer.auth_type, 
                               authorizer=my_cfn_authorizer)

推荐阅读