如何使用 AWS SAM 为 HttpApi 配置自定义域？

Question

我正在使用 AWS Lambda、AWS API 网关和 aws-sam 开发 API。我已经实施了 firebase 身份验证。我也使用嵌套堆栈。

我正在尝试为我的 API 端点使用自定义域，因此我可以调用 api.mydomain.com/products、api.mydomain.com/sales 等。我已准备好域和来自 AWS Certificate Manager 的证书。我什至设法在没有域配置的情况下部署我的 aws-sam 应用程序，然后通过 AWS API Gateway 网络控制台手动分配自定义域和域映射。

但我需要在 aws-sam 本身中完成该部分。下面是我试过的。

根堆栈

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aws-restapi

  Sample SAM Template for aws-restapi
  
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 5
    VpcConfig:
        SecurityGroupIds:
          - sg-041f215425921e8e
        SubnetIds:
          - subnet-0251b2d


Parameters:
  FirebaseProjectId:
    Type: String
  
  DomainName:
    Type: String
    Default: api.example.com

Resources:
  AuthGatewayHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Auth:
        Authorizers:
          FirebaseAuthorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              audience:
                - !Ref FirebaseProjectId
              issuer: !Sub https://securetoken.google.com/${FirebaseProjectId}
        DefaultAuthorizer: FirebaseAuthorizer

  AppDomainName:
    Type: AWS::ApiGateway::DomainName
    Properties:
      CertificateArn: arn:aws:acm:us-east-1:xxxxxxx43:certificate/1axxxf-3234-xxx2f-a61c-924eeexxxx9
      DomainName: !Ref DomainName

  APIBasePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      BasePath: "api"
      DomainName: !Ref AppDomainName
      Stage: "default"
      RestApiId: !Ref AuthGatewayHttpApi
  
  AuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: aws-restapi/
      Handler: source/testfile.lambdaHandler
      Runtime: nodejs14.x
      Events:
        Gateway:
          Type: HttpApi
          Properties:
            ApiId: !Ref AuthGatewayHttpApi
            Path: /hello
            Method: get

  GetAllAccountingTypesFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/accounting-types/accountingtypes-getall.getallaccountingtypes
      Runtime: nodejs14.x
      Events:
        GetAllAccountingTypesAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            ApiId: !Ref AuthGatewayHttpApi
            Path: /accountingtypes/getall
            Method: get

  GetAccountingTypeByIDFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/accounting-types/accountingtypes-byid.getbyid
      Runtime: nodejs14.x
      Events:
        GetAllAccountingTypesAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /accountingtypes/getbyid
            Method: get

嵌套堆栈

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aws-restapi

  Sample SAM Template for aws-restapi

Globals:
  Function:
    Timeout: 5
    VpcConfig:
        SecurityGroupIds:
          - sg-041f2459xxxx1e8e
        SubnetIds:
          - subnet-03xxxx2d

Parameters:
  FirebaseProjectId:
    Type: String

Resources:

  AuthGatewayHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Auth:
        Authorizers:
          FirebaseAuthorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              audience:
                - !Ref FirebaseProjectId
              issuer: !Sub https://securetoken.google.com/${FirebaseProjectId}
        DefaultAuthorizer: FirebaseAuthorizer

  GetAllPromotionsFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/promotions/promotions-getall.getAllPromotions
      Runtime: nodejs14.x
      Events:
        GetAllPromotionsAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /promotions/getall
            Method: get
            ApiId: !Ref AuthGatewayHttpApi
  SavePromotionsFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/promotions/promotions-save.savePromotions
      Runtime: nodejs14.x
      Events:
        SavePromotionsAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /promotions/save
            Method: get

但是我无法让它工作。我什至尝试仅将此应用于根堆栈，然后我遇到了以下错误。

Mixing of REST APIs and HTTP APIs on the same domain name can only be accomplished through API Gateway's V2 DomainName interface. 
Currently, WebSocket APIs can only be attached to a domain name with other WebSocket APIs. 
This must also occur through API Gateway's V2 DomainName interface. 
(Service: AmazonApiGateway; Status Code: 400; Error Code: BadRequestException; Request ID: 2f44d53b-8175-47f5-8bc8-db5 19aa484e7; Proxy: null)

如何成功配置要与 API 网关一起使用的自定义域？

Answer 1

添加域属性配置，示例如下：

AuthGatewayHttpApi:
  Type: AWS::Serverless::HttpApi
  Properties:
    Auth:
      Authorizers:
        FirebaseAuthorizer:
          IdentitySource: $request.header.Authorization
          JwtConfiguration:
            audience:
              - !Ref FirebaseProjectId
            issuer: !Sub https://securetoken.google.com/${FirebaseProjectId}
      DefaultAuthorizer: FirebaseAuthorizer
    Domain:
      DomainName: www.example.com
      CertificateArn: arn-example
      EndpointConfiguration: REGIONAL
      Route53:
        HostedZoneId: Z1PA6795UKMFR9

更多信息在这里：https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-httpapi-httpapidomainconfiguration.html#sam-property-httpapi-httpapidomainconfiguration--examples

如何使用 AWS SAM 为 HttpApi 配置自定义域？

How to configure a custom domain for HttpApi using AWS SAM?

amazon-web-services

aws-api-gateway

aws-cli

amazon-route53

aws-sam