我想使用 generated JavaScript API SDK
调用受 AWS_IAM 保护的 AWS API Gateway Endpoint
.
我有 Cognito UserPool and a Cognito Identity Pool . 两者都通过 ClientId
正确同步 .
我使用此代码 Sign in
并获取 Cognito Identity
AWS.config.region = 'us-east-1'; // Region
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: 'us-east-1:XXXXXXXXXXXXXXXXXXXXXXXX' // your identity pool id here
});
AWSCognito.config.region = 'us-east-1';
AWSCognito.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: 'us-east-1:XXXXXXXXXXXXXXXXXXXXXXXX' // your identity pool id here
});
var poolData = {
UserPoolId: 'us-east-1_XXXXXXXX',
ClientId: 'XXXXXXXXXXXXXXXXXXXXXXXX'
};
var userPool = new AWSCognito.CognitoIdentityServiceProvider.CognitoUserPool(poolData);
var authenticationData = {
Username: 'user',
Password: '12345678',
};
var authenticationDetails = new AWSCognito.CognitoIdentityServiceProvider.AuthenticationDetails(authenticationData);
var userData = {
Username: 'user',
Pool: userPool
};
var cognitoUser = new AWSCognito.CognitoIdentityServiceProvider.CognitoUser(userData);
cognitoUser.authenticateUser(authenticationDetails, {
onSuccess: function (result) {
console.log('access token + ' + result.getAccessToken().getJwtToken());
AWS.config.credentials = new AWS.CognitoIdentityCredentials({
IdentityPoolId: 'us-east-1:XXXXXXXXXXXXXXXXXXXX',
IdentityId: AWS.config.credentials.identityId,
Logins: {
'cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXXXX': result.idToken.jwtToken
}
});
AWS.config.credentials.get(function (err) {
// now I'm using authenticated credentials
if(err)
{
console.log('error in autheticatig AWS'+err);
}
else
{
console.log(AWS.config.credentials.identityId);
}
});
},
onFailure: function (err) {
alert(err);
}
});
所有这一切都成功了,我现在有一个 authorized Cognito Identity
.
现在我尝试调用 API Gateway Endpoint
来执行它指向的 Lambda Function
.
var apigClient = apigClientFactory.newClient({
accessKey: AWS.config.credentials.accessKeyId, //'ACCESS_KEY',
secretKey: AWS.config.credentials.secretAccessKey, //'SECRET_KEY',
sessionToken: AWS.config.credentials.sessionToken, // 'SESSION_TOKEN', //OPTIONAL: If you are using temporary credentials you must include the session token
region: 'us-east-1' // OPTIONAL: The region where the API is deployed, by default this parameter is set to us-east-1
});
var params = {
// This is where any modeled request parameters should be added.
// The key is the parameter name, as it is defined in the API in API Gateway.
};
var body = {
// This is where you define the body of the request,
query: '{person {firstName lastName}}'
};
var additionalParams = {
// If there are any unmodeled query parameters or headers that must be
// sent with the request, add them here.
headers: {},
queryParams: {}
};
apigClient.graphqlPost(params, body, additionalParams)
.then(function (result) {
// Add success callback code here.
console.log(result);
}).catch(function (result) {
// Add error callback code here.
console.log(result);
});
但不幸的是,这失败了 . OPTIONS
请求成功 200
但 POST
则失败 403
.
我很确定这里没有 CORS
问题 .
我很确定这个问题与 IAM Roles
和 AWS Resource Configurations
有关 .
我的问题基本上是,你可以请我提供所需的所有必要的 AWS Resource Configurations
和 IAM Roles
吗?
我有的资源是
-
API网关 - 使用已部署的API endpoints
-
Lambda函数 - 由 endpoints 调用
-
Cognito用户池 - 同步应用程序同步到身份池
-
Cognito Identity Pool - 将授权和未授权角色映射到它 .
-
IAM角色 - 用于Lambda函数以及Cognito标识池的授权和未授权角色 .
但我不知道如何正确配置这些资源以使其工作 .
谢谢
2 回答
Cognito Identity的角色具有哪些访问权限?确保它有权在您的API上执行
execute-api:Invoke
.您可以从Web控制台中的方法设置页面获取确切的资源ARN .
即使在完成所有事情之后我也会遇到同样的错误 . 原因是我在初始化apigClient时错过了“sessionToken” .
//OPTIONAL: If you are using temporary credentials you must include the session token - 不是真的可选