AWS API 的自定义 request-based lambda 授权方不会因 API 创新而触发网关

Question

已根据文档 (https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html)

为我的 AWS API 网关创建了一个简单的基本 request-based 授权方

在测试授权器时（使用虚拟设置验证授权 header 中是否有密钥 'test'）授权器工作正常，但直接从端点调用 API授权者根本没有被调用，我得到了我的 API 响应（应该被阻止，因为没有通过 header）。

使用无效密钥的授权方测试：得到预期的 401

使用有效密钥的授权方测试：预期为 200

直接从网络调用 API endpoing 成功：

我的 API 网关资源策略希望限制仅来自特定 IP 范围的调用：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:111111111111:6mm9kw17uf/*/*/*"
        },
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-east-1:111111111111:6mm9kw17uf/*/*/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": "XXXXXXX"
                }
            }
        }
    ]
}

授权方 Lambda 代码：

exports.handler = function(event, context, callback) {        
    console.log('Received event:', JSON.stringify(event, null, 2));

    // Retrieve request parameters from the Lambda function input:
    var headers = event.headers;
        
    // Parse the input for the parameter values
    var tmp = event.methodArn.split(':');
    var apiGatewayArnTmp = tmp[5].split('/');
    var awsAccountId = tmp[4];
    var region = tmp[3];
    var restApiId = apiGatewayArnTmp[0];
    var stage = apiGatewayArnTmp[1];
    var method = apiGatewayArnTmp[2];
    var resource = '/'; // root resource
    if (apiGatewayArnTmp[3]) {
        resource += apiGatewayArnTmp[3];
    }
        
    // Perform authorization to return the Allow policy for correct parameters and 
    // the 'Unauthorized' error, otherwise.
    var authResponse = {};
    var condition = {};
    condition.IpAddress = {};
     
    if (headers.Authorization === "test") {
        callback(null, generateAllow('me', event.methodArn));
    }  else {
        callback("Unauthorized");
    }
}
     
// Help function to generate an IAM policy
var generatePolicy = function(principalId, effect, resource) {
    // Required output:
    var authResponse = {};
    authResponse.principalId = principalId;
    if (effect && resource) {
        var policyDocument = {};
        policyDocument.Version = '2012-10-17';
        policyDocument.Statement = [];
        var statementOne = {};
        statementOne.Action = 'execute-api:Invoke';
        statementOne.Effect = effect;
        statementOne.Resource = resource;
        policyDocument.Statement[0] = statementOne;
        authResponse.policyDocument = policyDocument;
    }
    return authResponse;
}
     
var generateAllow = function(principalId, resource) {
    return generatePolicy(principalId, 'Allow', resource);
}
     
var generateDeny = function(principalId, resource) {
    return generatePolicy(principalId, 'Deny', resource);
}

我已经尝试过的：

1. 添加授权人后，我已经 re-deployed API 了。
2. 我正在通过邮递员和 Web 浏览器进行测试，而不是网关测试，因为它会绕过授权方。

Answer 1

我尝试使用我自己的 API 网关复制那个问题，但我没有发现任何问题你的 lambda 函数。它按预期工作。

授权调用示例[​​=36=]：

curl -i -w "\n" --http1.1 -H 'Authorization: test' https://xxxxx.execute-api.us-east-1.amazonaws.com/dev/helloworld


HTTP/1.1 200 OK
Date: Sun, 06 Sep 2020 11:22:30 GMT
Content-Type: application/json
Content-Length: 67
Connection: keep-alive
x-amzn-RequestId: 4213f276-737c-4481-bbac-3c4ecd767b6f
x-amz-apigw-id: ScPyeFInoAMFYKg=
X-Amzn-Trace-Id: Root=1-5f54c676-9e0c8bbe6093d8889f6b2035;Sampled=0

{
    "statusCode": 200,
    "message": "Hello from API Gateway!"
}

non-authorized调用示例[​​=36=]：

curl -i -w "\n" --http1.1 -H 'Authorization: invalid' https://xxxx.execute-api.us-east-1.amazonaws.com/dev/helloworld


HTTP/1.1 401 Unauthorized
Date: Sun, 06 Sep 2020 11:25:36 GMT
Content-Type: application/json
Content-Length: 26
Connection: keep-alive
x-amzn-RequestId: 42a1d47c-aab5-4b72-b8eb-469fed383b26
x-amzn-ErrorType: UnauthorizedException
x-amz-apigw-id: ScQPpFUwoAMFRdA=

{"message":"Unauthorized"}

提供的 no-header 值 示例：

curl -i -w "\n" --http1.1  https://xxxx.execute-api.us-east-1.amazonaws.com/dev/helloworld

HTTP/1.1 401 Unauthorized
Date: Sun, 06 Sep 2020 11:26:15 GMT
Content-Type: application/json
Content-Length: 26
Connection: keep-alive
x-amzn-RequestId: 982944f2-ac1d-4eee-8776-7bfa76314d2b
x-amzn-ErrorType: UnauthorizedException
x-amz-apigw-id: ScQVwGmpoAMFfSA=

{"message":"Unauthorized"}

需要考虑的事项：

1. 当您将授权器添加到您的 api 方法时，您必须再次 部署阶段。
2. 新授权方开始工作需要时间。因此，在您启用它并创建新阶段后，必须等待几分钟才能开始工作