AWS APIGatewayv2 授权器
此API 可能会发出警告 。 后向兼容性没有保证 .
所有构造移到 aws- cdk-lib/aws- apigatewayv2 授权器 .
目录
导言
API Gateway 支持控制和管理您 HTTP API 访问的多机制. 他们主要是 分为Lambda授权者,JWT授权者,以及标准的AWS IAM角色和政策. 更多信息为: 可用时间 控制和管理对 HTTP 的访问 API 密码。 。 。 .
HTTP API 软件
HTTP API的接入控制是通过限制哪些路由可以被引用来管理.
授权器和范围可以适用于API,也可以具体适用于每个路由.
默认授权
在使用默认的授权时,API的所有路由都会继承配置.
在下文的例子中,所有路线都要求 manage:books (a) 为援引合并而存在的范围.
import { HttpJwtAuthorizer } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
const issuer = 'https://test.us.auth0.com';
const authorizer = new HttpJwtAuthorizer('DefaultAuthorizer', issuer, {
jwtAudience: ['3131231'],
});
const api = new apigwv2.HttpApi(this, 'HttpApi', {
defaultAuthorizer: authorizer,
defaultAuthorizationScopes: ['manage:books'],
});
路由授权
也可以为每个路由配置授权. 在配置路由授权时,它优先于默认授权.
下面的例子展示了默认的授权,以及路由的授权. 它还展示了如何完全取消对一条路线的授权.
GET /books财务报告和审定财务报表GET /books/{id}使用 api 上的默认授权设置POST /books将要求['write:books']范围POST /login删除默认授权者( 未认证的路由)
import { HttpJwtAuthorizer } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
import { HttpUrlIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
const issuer = 'https://test.us.auth0.com';
const authorizer = new HttpJwtAuthorizer('DefaultAuthorizer', issuer, {
jwtAudience: ['3131231'],
});
const api = new apigwv2.HttpApi(this, 'HttpApi', {
defaultAuthorizer: authorizer,
defaultAuthorizationScopes: ['read:books'],
});
api.addRoutes({
integration: new HttpUrlIntegration('BooksIntegration', 'https://get-books-proxy.example.com'),
path: '/books',
methods: [apigwv2.HttpMethod.GET],
});
api.addRoutes({
integration: new HttpUrlIntegration('BooksIdIntegration', 'https://get-books-proxy.example.com'),
path: '/books/{id}',
methods: [apigwv2.HttpMethod.GET],
});
api.addRoutes({
integration: new HttpUrlIntegration('BooksIntegration', 'https://get-books-proxy.example.com'),
path: '/books',
methods: [apigwv2.HttpMethod.POST],
authorizationScopes: ['write:books']
});
api.addRoutes({
integration: new HttpUrlIntegration('LoginIntegration', 'https://get-books-proxy.example.com'),
path: '/login',
methods: [apigwv2.HttpMethod.POST],
authorizer: new apigwv2.HttpNoneAuthorizer(),
});
JWT 授权者
JWT授权人允许使用JSON Web Tokens(JWTs)作为以下内容的一部分: OpenID 连接 财务报告和审定财务报表 OAuth 2.0 数据 用于允许和限制客户端访问 HTTP API 的框架.
配置时,API Gateway验证客户端提交的JWT,并根据其内容允许或拒绝访问.
符号的位置由 identitySource 默认为 HTTP Authorization 头曰. 不过,它也
支持若干其他选项。 。 。 .
然后根据授权人和路线(范围)中定义的选项,对JWT进行解码并验证签名和索赔.
更多信息请检查 JWT 授权文件。 。 。 .
未获得授权的客户可收到2个答复:
401 - Unauthorized当JWT验证失败时403 - Forbidden- 当JWT验证成功但所需范围未达到时
import { HttpJwtAuthorizer } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
import { HttpUrlIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
const issuer = 'https://test.us.auth0.com';
const authorizer = new HttpJwtAuthorizer('BooksAuthorizer', issuer, {
jwtAudience: ['3131231'],
});
const api = new apigwv2.HttpApi(this, 'HttpApi');
api.addRoutes({
integration: new HttpUrlIntegration('BooksIntegration', 'https://get-books-proxy.example.com'),
path: '/books',
authorizer,
});
用户池授权器
用户池授权器(User Pool Authorizer)是JWT授权器的一种,使用Cognitto用户池和app客户端来控制谁可以访问你的API. 在应用程序客户端成功授权后,所生成的访问符将被用作JWT.
客户端访问使用用户池授权的API,必须先在用户池签名并获得身份或访问令牌.
然后他们必须在指定的 identitySource aPI电话 更多信息,请访问 使用 Amazon Cognitto 用户
作为授权方的集合。 。 。 .
import * as cognito from 'aws-cdk-lib/aws-cognito';
import { HttpUserPoolAuthorizer } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
import { HttpUrlIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
const userPool = new cognito.UserPool(this, 'UserPool');
const authorizer = new HttpUserPoolAuthorizer('BooksAuthorizer', userPool);
const api = new apigwv2.HttpApi(this, 'HttpApi');
api.addRoutes({
integration: new HttpUrlIntegration('BooksIntegration', 'https://get-books-proxy.example.com'),
path: '/books',
authorizer,
});
Lambda 授权者
Lambda授权方使用Lambda函数来控制对您HTTP API的访问. 当客户端调用您的 API 时, API Gateway 引用了您的 Lambda 函数并使用响应来确定客户端是否可以访问您的 API .
Lambda授权者视其反应而定,属于两种类型――简单型或IAM型。 你可以学会不同 这里。 。 。 .
import { HttpLambdaAuthorizer, HttpLambdaResponseType } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
import { HttpUrlIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
// This function handles your auth logic
declare const authHandler: lambda.Function;
const authorizer = new HttpLambdaAuthorizer('BooksAuthorizer', authHandler, {
responseTypes: [HttpLambdaResponseType.SIMPLE], // Define if returns simple and/or iam response
});
const api = new apigwv2.HttpApi(this, 'HttpApi');
api.addRoutes({
integration: new HttpUrlIntegration('BooksIntegration', 'https://get-books-proxy.example.com'),
path: '/books',
authorizer,
});
IAM 授权者
API 网关通过包含的内容支持 IAM HttpIamAuthorizer 和赠款语法:
import { HttpIamAuthorizer } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
import { HttpUrlIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
declare const principal: iam.AnyPrincipal;
const authorizer = new HttpIamAuthorizer();
const httpApi = new apigwv2.HttpApi(this, 'HttpApi', {
defaultAuthorizer: authorizer,
});
const routes = httpApi.addRoutes({
integration: new HttpUrlIntegration('BooksIntegration', 'https://get-books-proxy.example.com'),
path: '/books/{book}',
});
routes[0].grantInvoke(principal);
网络锁定 APIs
您可以为您的 WebSocket API 设置授权程序 $connect 用于控制访问您的 API 的路由.
Lambda 授权者
Lambda授权者使用 Lambda 函数来控制对您的 WebSocket API 的访问. 当客户端连接到您的 API时, API Gateway 引用了您的 Lambda 函数并使用响应来确定客户端是否能够访问您的 API .
import { WebSocketLambdaAuthorizer } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
import { WebSocketLambdaIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
// This function handles your auth logic
declare const authHandler: lambda.Function;
// This function handles your WebSocket requests
declare const handler: lambda.Function;
const authorizer = new WebSocketLambdaAuthorizer('Authorizer', authHandler);
const integration = new WebSocketLambdaIntegration(
'Integration',
handler,
);
new apigwv2.WebSocketApi(this, 'WebSocketApi', {
connectRouteOptions: {
integration,
authorizer,
},
});
IAM 授权器
IAM授权程序可用于允许基于身份的访问您的WebSocket API.
import { WebSocketIamAuthorizer } from '@aws-cdk/aws-apigatewayv2-authorizers-alpha';
import { WebSocketLambdaIntegration } from '@aws-cdk/aws-apigatewayv2-integrations-alpha';
// This function handles your connect route
declare const connectHandler: lambda.Function;
const webSocketApi = new apigwv2.WebSocketApi(this, 'WebSocketApi');
webSocketApi.addRoute('$connect', {
integration: new WebSocketLambdaIntegration('Integration', connectHandler),
authorizer: new WebSocketIamAuthorizer()
});
// Create an IAM user (identity)
const user = new iam.User(this, 'User');
const webSocketArn = Stack.of(this).formatArn({
service: 'execute-api',
resource: webSocketApi.apiId,
});
// Grant access to the IAM user
user.attachInlinePolicy(new iam.Policy(this, 'AllowInvoke', {
statements: [
new iam.PolicyStatement({
actions: ['execute-api:Invoke'],
effect: iam.Effect.ALLOW,
resources: [webSocketArn],
}),
],
}));