AWS CDK - API 网关上的 Cognito UserPool 授权方无法正常工作

Question

我的目标是设置一些 lambda 功能，这些功能是公共的（即发送请求不需要授权）和其他需要用户在 Cognito UserPool 中登录的功能。

在我下面的 CDK 文件中，我只在两个端点之一上添加了一个授权者，但是当我启动请求时，它们都不受保护，并且在 function 日志中，您可以看到没有 Cognito UserPool 或 AuthenticationType。

关于缺少什么的任何想法？

谢谢！

{
   "httpMethod":"GET",
   "body":null,
   "resource":"/private",
   "requestContext":{
      ...,
      "identity":{
         "apiKey":null,
         "userArn":null,
         "cognitoAuthenticationType":null,
         "caller":null,
         "userAgent":"Custom User Agent String",
         "user":null,
         "cognitoIdentityPoolId":null,
         "cognitoAuthenticationProvider":null,
         "sourceIp":"127.0.0.1",
         "accountId":null
      },
      ...
   },
   ...
}

CDK文件：

import * as apigateway from '@aws-cdk/aws-apigateway';
import * as lambda from '@aws-cdk/aws-lambda';
import * as s3 from '@aws-cdk/aws-s3';
import { UserPool, VerificationEmailStyle, UserPoolClient } from '@aws-cdk/aws-cognito'
import { App, CfnParameter, Duration, Stack, StackProps } from '@aws-cdk/core';


export class CdkStack extends Stack {
    constructor(scope: App, id: string, props: StackProps) {
        super(scope, id, props);

        new CfnParameter(this, 'AppId');

        const userPool = new UserPool(this, 'dev-users', {
            userPoolName: 'dev-users',
            selfSignUpEnabled: true,
            userVerification: {
                emailSubject: 'Verify your email for our awesome app!',
                emailBody: 'Hello {username}, Thanks for signing up to our awesome app! Your verification code is {####}',
                emailStyle: VerificationEmailStyle.CODE,
                smsMessage: 'Hello {username}, Thanks for signing up to our awesome app! Your verification code is {####}',
            },
            signInAliases: {
                email: true
            },
            signInCaseSensitive: false,
            standardAttributes: {
                email: { required: true, mutable: false }
            },
            passwordPolicy: {
                minLength: 6,
                requireLowercase: true,
                requireUppercase: true,
                requireDigits: true,
                requireSymbols: false,
                tempPasswordValidity: Duration.days(7),
            }
        })

        const environment = {  };
        // The code will be uploaded to this location during the pipeline's build step
        const artifactBucket = s3.Bucket.fromBucketName(this, 'ArtifactBucket', process.env.S3_BUCKET!);
        const artifactKey = `${process.env.CODEBUILD_BUILD_ID}/function-code.zip`;
        const code = lambda.Code.fromBucket(artifactBucket, artifactKey);

        // This is a Lambda function config associated with the source code: get-all-items.js
        const publicFunction = new lambda.Function(this, 'publicFunction', {
            description: 'A simple example includes a HTTP get method accessible to everyone',
            handler: 'src/handlers/public.publicHandler',
            runtime: lambda.Runtime.NODEJS_10_X,
            code,
            environment,
            timeout: Duration.seconds(60),
        });
        // Give Read permissions to the SampleTable


        // This is a Lambda function config associated with the source code: put-item.js
        const privateFunction = new lambda.Function(this, 'privateFunction', {
            description: 'This functions should only be accessible to authorized users from a Cognito UserPool',
            handler: 'src/handlers/private.privateHandler',
            runtime: lambda.Runtime.NODEJS_10_X,
            code,
            timeout: Duration.seconds(60),
            environment,
        });

        const api = new apigateway.RestApi(this, 'ServerlessRestApi', { cloudWatchRole: false });

        const authorizer = new apigateway.CfnAuthorizer(this, 'cfnAuth', {
            restApiId: api.restApiId,
            name: 'HelloWorldAPIAuthorizer',
            type: 'COGNITO_USER_POOLS',
            identitySource: 'method.request.header.Authorization',
            providerArns: [userPool.userPoolArn],
        })

        api.root.addResource('public').addMethod(
            'GET',
            new apigateway.LambdaIntegration(publicFunction)
        );
        api.root.addResource('private').addMethod(
            'GET',
            new apigateway.LambdaIntegration(privateFunction),
            {
                authorizationType: apigateway.AuthorizationType.COGNITO,
                authorizer: {
                    authorizerId: authorizer.ref
                }
            }
        );
    }
}

const app = new App();
new CdkStack(app, 'CognitoProtectedApi', {});
app.synth();

Answer 1

尝试在您的addMethod中执行以下操作。

{
  authorizationType: apigateway.AuthorizationType.COGNITO,
  authorizer // pass the authorizer object instead of authorizerId stuff.
}

有关详细信息，请参阅https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_apigateway.CognitoUserPoolsAuthorizer.html 。

以下是 AWS CDK 2.20.0

您可以创建一个CognitoUserPoolsAuthorizer ，然后将其附加为 API GW 的默认授权方，或将其附加到特定路由。

要添加到特定方法，

const userPool = new cognito.UserPool(this, 'UserPool');

const auth = new apigateway.CognitoUserPoolsAuthorizer(this, 'booksAuthorizer', {
  cognitoUserPools: [userPool]
});

declare const books: apigateway.Resource;
books.addMethod('GET', new apigateway.HttpIntegration('http://amazon.com'), {
  authorizer: auth,
  authorizationType: apigateway.AuthorizationType.COGNITO,
})

参考https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_apigateway.CognitoUserPoolsAuthorizer.html