如何从 lambda 调用 IAM 授权的 AWS ApiGateway 端点？

Question

I'm trying to invoke an AWS ApiGateway HTTP endpoint from a lambda function that I've secured using an IAM authorizer, however I cannot for the life of me get anything from my lambda function to work.

I've tested the endpoint with Postman, and can confirm that it works when I select "AWS Signature" as the Authorization type and put in my local credentials, so it's not an issue with how the endpoint is set up. It must be an issue with how I am sending the request from Lambda. The additional challenge is adding the headers to a GraphQL API request.

This is what my lambda function looks like:

import { ApolloServer } from 'apollo-server-lambda';
import { APIGatewayProxyEvent, Callback, Context } from 'aws-lambda';
import { ApolloGateway, RemoteGraphQLDataSource } from '@apollo/gateway';
import aws4 from 'aws4';

const userServiceUrl = process.env.USER_SERVICE_URL;
const {hostname, pathname} = new URL(userServiceUrl);

class AuthenticatedDataSource extends RemoteGraphQLDataSource {
  willSendRequest({request}) {
    console.log('request is: ', request);
    const opts: Record<string, any> = {
      service: 'execute-api',
      region: process.env.AWS_REGION,
      host: hostname,
      path: pathname,
      body: JSON.stringify({query: request.query}),
      method: 'POST'
    }
    aws4.sign(opts);
    console.log('opts are: ', opts);
    request.http.headers.set('X-Amz-Date', opts.headers['X-Amz-Date']);
    request.http.headers.set('Authorization', opts.headers['Authorization']);
    request.http.headers.set('X-Amz-Security-Token', opts.headers['X-Amz-Security-Token']);
  }
}

No matter what I try I always get a 403 forbidden error and the request never makes it to the actual endpoint behind the authorizer. I've tried removing body, I've tried hardcoding my local credentials into the aws4 call, none of it works. My hunch is that my signature call is wrong somehow, but when I compare it to the few examples I've found on the inte.net I can't see anything obviously wrong.

Any resources that could point me in the right direction would be greatly appreciated. Most of the examples I find are front end specific so I know that could possibly be steering me wrong.

Answer 1

The willSendRequest function is not the best place to sign the request as apollo-server can modify the request object after willSendRequest is invoked. Instead you should implement a custom fetch and pass it to the RemoteGraphQLDataSource constructor to ensure that you are signing the final request before it is sent.

your custom GraphQLDataSource with custom fetch would be something like this:

import { Request, RequestInit, Response, fetch, Headers } from "apollo-server-env";
import aws4 from 'aws4';
import { RemoteGraphQLDataSource } from '@apollo/gateway';

class AuthenticatedDataSource extends RemoteGraphQLDataSource {
    public constructor(
        url: string,
    ) {
        super({
            url: url,
            fetcher: doFetch,
        });
    }

    async doFetch(
        input?: string | Request | undefined,
        init?: RequestInit | undefined
    ): Promise<Response> {
        const url = new URL(input as string);
        const opts: Record<string, any> = {
            service: 'execute-api',
            region: process.env.AWS_REGION,
            host: url.hostname,
            path: url.pathname,
            body: init?.body,
            method: init?.method
        }
        aws4.sign(opts);
        init.headers.set('X-Amz-Date', opts.headers['X-Amz-Date']);
        init.headers.set('Authorization', opts.headers['Authorization']);
        init.headers.set('X-Amz-Security-Token', opts.headers['X-Amz-Security-Token']);
        const response = await fetch(input, init);

        return response;
    }
}

Answer 2

For prosperity, this is what I ended up doing and works flawlessly (Thank you so much Glen Thomas!)

import { Request, RequestInit, Response, fetch } from "apollo-server-env";
import { ApolloServer } from 'apollo-server-lambda';
import { APIGatewayProxyEvent, Callback, Context } from 'aws-lambda';
import { ApolloGateway, RemoteGraphQLDataSource } from '@apollo/gateway';
import aws4 from 'aws4';

const userServiceUrl = process.env.USER_SERVICE_URL;

async function doFetch(
  input?: Request | string,
  init?: RequestInit
): Promise<Response> {
  const urlString = typeof input === 'string' ? input : input.url;
  const url = new URL(urlString);
  const opts: Record<string, any> = {
    service: 'execute-api',
    region: process.env.AWS_REGION,
    host: url.hostname,
    path: url.pathname,
    body: init?.body,
    method: init?.method
  }
  aws4.sign(opts);
  init.headers = opts.headers;
  const response = await fetch(input, init);

  return response;
}

class AuthenticatedDataSource extends RemoteGraphQLDataSource {
  constructor(url: string) {
    super({
      url,
      fetcher: doFetch
    })
  }
}

const server = new ApolloServer({
  gateway: new ApolloGateway({
    serviceList: [
      { name: 'users', url: userServiceUrl }
    ],
    buildService({url}) {
      return new AuthenticatedDataSource(url)
    }
  }),
  subscriptions: false,
  introspection: true,
  playground: true,
});

export const handler = (event: APIGatewayProxyEvent, context: Context, callback: Callback) => {
  console.log('event is: ', JSON.stringify(event, null, 2))
  
  return server.createHandler({
    cors: {
      origin: '*'
    }
  })(event, context, callback);
}

Answer 3

Actually, willSendRequest works fine, and is preferred for simplicity. For cases you want to sign the request for specific data sources with an easy setup.

The reason why the documented attempts failed is because the request signing needs to be exact: Path must contain both the path & query parameters. https is also stripped as the corresponding AWS signature error indicated the host to not have one.

GET request

  willSendRequest(request: RequestOptions) {
    const query = request.params ? `?${request.params.toString()}` : "";
    const opts: Record<string, any> = {
      service: "execute-api",
      region: process.env.AWS_REGION,
      host: this.baseURL?.replace("https://", ""),
      path: request.path + query,
      method: request.method,
    };

    sign(opts);

    request.headers.set("X-Amz-Date", opts.headers["X-Amz-Date"]);
    request.headers.set("Authorization", opts.headers["Authorization"]);
    request.headers.set(
      "X-Amz-Security-Token",
      opts.headers["X-Amz-Security-Token"]
    );
  }

POST Request

Fragment example, from another JS lambda (not apollo-graphql) having a body; not sure if apollo automatically decodes the body, regardless it's a good example to showcase.

  if (Object.hasOwnProperty.call(request, 'body')) {
    const { data, encoding } = request.body;
    const buffer = Buffer.from(data, encoding);
    const decodedBody = buffer.toString('utf8');

    if (decodedBody !== '') {
      normalisedRequest.body = decodedBody;
      normalisedRequest.headers = { 'content-type': request.headers['content-type'][0].value };
    }
  }