Question

我正在使用AWS SAM Cli和模板部署无服务器应用程序，但是在尝试卷曲/邮递时，API Gateway资源返回403 ForbiddenException错误。尝试过在线查找，但找不到任何解决我问题的答案，并且想知道这里是否有人曾经历过此事。

template.yaml：

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31


Globals:
  Function:
    Runtime: nodejs10.x
    MemorySize: 256

  Api:
    Cors:
      AllowMethods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
      AllowHeaders: "'Content-Type,X-Amz-Date,X-Amz-Security-Token,Authorization,X-Api-Key,X-Requested-With,Accept,Access-Control-Allow-Methods,Access-Control-Allow-Origin,Access-Control-Allow-Headers'"
      AllowOrigin: "'*'"

Parameters:
  ApiKey:
    Type: String
    Default: none

Conditions:
  CreateApiKey: !Not [!Equals [!Ref ApiKey, 'none']]

Resources:
  # DynamoDB table setup
  DyanmoDBStoryTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Stories
      AttributeDefinitions:
        - AttributeName: short_id
          AttributeType: S
      KeySchema:
        - AttributeName: short_id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 0
        WriteCapacityUnits: 0
      BillingMode: PAY_PER_REQUEST

  # Log group
  DynamoSaveStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoSaveStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoSaveStoryLambda}'
  DynamoGetStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoGetStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoGetStoryLambda}'
  DynamoUpdateStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoUpdateStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoUpdateStoryLambda}'

  # Lambda Fn
  DynamoSaveStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/save-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story
            Method: post

  DynamoGetStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/get-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story/{shortId}
            Method: get

  DynamoUpdateStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/update-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story/{shortId}
            Method: post

  # Custom API gateway setup API Keys & usage plans
  ApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        ApiKeyRequired: true

  UsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    DependsOn: [ApiGatewayProdStage]
    Condition: CreateApiKey
    Properties:
      ApiStages:
        - ApiId: !Ref ApiGateway
          Stage: Prod

  DynamoLambdasApiKey:
    Type: AWS::ApiGateway::ApiKey
    DependsOn: [UsagePlan]
    Condition: CreateApiKey
    Properties:
      Value: !Ref ApiKey
      Enabled: true
      StageKeys:
        - RestApiId: !Ref ApiGateway
          StageName: Prod

  UsagePlanKey:
    Type: AWS::ApiGateway::UsagePlanKey
    Condition: CreateApiKey
    Properties:
      KeyId: !Ref DynamoLambdasApiKey
      KeyType: API_KEY
      UsagePlanId: !Ref UsagePlan

Outputs:
  StoryApi:
    Description: Serverless api url generated by AWS Cloudformation upon stack deployment
    Value: !Sub 'https://${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com/prod'
  ApiKey:
    Description: Api key to authorize access in API Gateway
    Value: !Ref ApiKey

SAM CLI Version: 0.47.0

错误：

Date →Sun, 26 Apr 2020 19:22:02 GMT
Content-Type →application/json
Content-Length →23
Connection →keep-alive
x-amzn-RequestId →01d6b9ec-dcf0-484c-be07-6b629437b305
x-amzn-ErrorType →ForbiddenException
x-amz-apigw-id →Lm_WOF9ZvHcF7nQ=

直接从AWS Lambda控制台进行测试可以正常工作，并生成cloudwatch日志，但是当我卷曲/邮递员使用部署期间生成的API URL进行请求时，则不能。我尝试了以下方法：

确保正确设置x-api-key标头，并验证是否使用正确的API密钥设置了AWS控制台中的API网关
以模板的全局方式在API中配置CORS。确认它会在API Gateway控制台中创建options端点
再次检查端点是否正确

该错误指出这是一个云问题，因此我已确认S3存储桶具有公共访问权限。 AWS控制台中没有其他Cloudfront资源。我对阻止请求的内容不知所措。

Answer 1

答案比我想象的要简单，但是对于遇到此问题的其他人，查询参数区分大小写。无服务器应用程序模型部署的输出URL返回https://${serverlessAppId}.execute-api.${region}.amazonaws.com/${StageName}。

在我的情况下，StageName是Prod，我以prod的身份提出请求

CloudFront 403禁止的异常（AWS SAM模板）

1 个答案: