如何使用Cognito Id（+配置）调用AWS API网关端点？

Question

我想致电AWS API Gateway Endpoint使用generated JavaScript API SDK使用AWS_IAM保护。

我有一个Cognito UserPool和一个Cognito Identity Pool。两者都通过ClientId正确同步。

我使用此代码Sign in并获得Cognito Identity

AWS.config.region = 'us-east-1'; // Region 
AWS.config.credentials = new AWS.CognitoIdentityCredentials({ 
    IdentityPoolId: 'us-east-1:XXXXXXXXXXXXXXXXXXXXXXXX' // your identity pool id here 
}); 

AWSCognito.config.region = 'us-east-1'; 
AWSCognito.config.credentials = new AWS.CognitoIdentityCredentials({ 
    IdentityPoolId: 'us-east-1:XXXXXXXXXXXXXXXXXXXXXXXX' // your identity pool id here 
}); 

var poolData = { 
    UserPoolId: 'us-east-1_XXXXXXXX', 
    ClientId: 'XXXXXXXXXXXXXXXXXXXXXXXX' 
}; 
var userPool = new AWSCognito.CognitoIdentityServiceProvider.CognitoUserPool(poolData); 


var authenticationData = { 
    Username: 'user', 
    Password: '12345678', 
}; 
var authenticationDetails = new AWSCognito.CognitoIdentityServiceProvider.AuthenticationDetails(authenticationData); 
var userData = { 
    Username: 'user', 
    Pool: userPool 
}; 
var cognitoUser = new AWSCognito.CognitoIdentityServiceProvider.CognitoUser(userData); 
cognitoUser.authenticateUser(authenticationDetails, { 
    onSuccess: function (result) { 
    console.log('access token + ' + result.getAccessToken().getJwtToken()); 

    AWS.config.credentials = new AWS.CognitoIdentityCredentials({ 
    IdentityPoolId: 'us-east-1:XXXXXXXXXXXXXXXXXXXX', 
    IdentityId: AWS.config.credentials.identityId, 
    Logins: { 
     'cognito-idp.us-east-1.amazonaws.com/us-east-1_XXXXXX': result.idToken.jwtToken 
    } 
    }); 

    AWS.config.credentials.get(function (err) { 
    // now I'm using authenticated credentials 
    if(err) 
    { 
     console.log('error in autheticatig AWS'+err); 
    } 
    else 
    { 
     console.log(AWS.config.credentials.identityId); 

    } 
    }); 
    }, 

    onFailure: function (err) { 
    alert(err); 
    } 

}); 

这一切成功，我有一个authorized Cognito Identity现在。

现在我试着打电话给API Gateway Endpoint去执行它指向的Lambda Function。

var apigClient = apigClientFactory.newClient({ 
    accessKey: AWS.config.credentials.accessKeyId, //'ACCESS_KEY', 
    secretKey: AWS.config.credentials.secretAccessKey, //'SECRET_KEY', 
    sessionToken: AWS.config.credentials.sessionToken, // 'SESSION_TOKEN', //OPTIONAL: If you are using temporary credentials you must include the session token 
    region: 'us-east-1' // OPTIONAL: The region where the API is deployed, by default this parameter is set to us-east-1 
    }); 

    var params = { 
    // This is where any modeled request parameters should be added. 
    // The key is the parameter name, as it is defined in the API in API Gateway. 
    }; 

    var body = { 
    // This is where you define the body of the request, 
    query: '{person {firstName lastName}}' 
    }; 

    var additionalParams = { 
    // If there are any unmodeled query parameters or headers that must be 
    // sent with the request, add them here. 
    headers: {}, 
    queryParams: {} 
    }; 

    apigClient.graphqlPost(params, body, additionalParams) 
    .then(function (result) { 
     // Add success callback code here. 
     console.log(result); 
    }).catch(function (result) { 
    // Add error callback code here. 
    console.log(result); 
    }); 

但不幸的是，这失败了。 OPTIONS请求成功与200，但POST然后与403失败。

我很确定这里没有CORS的问题。

我很确定这个问题与IAM Roles和AWS Resource Configurations有关。

我的问题基本上是否可以请你提供我需要的所有必要的AWS Resource Configurations和IAM Roles？

资源我已经被

• API网关 - 与部署API端点
• lambda函数 - 称为由端点
• Cognito用户群 - 与应用程序同步到身份池
• Cognito身份池 - 授权和未授权角色映射到它。
• IAM角色 - 用于Lambda函数以及Cognito身份池的授权和未授权角色。

但我不知道如何正确配置这些资源以使其正常工作。

谢谢

Answer 1

Cognit Identity的角色有哪些访问权限？确保它有权在您的API上执行execute-api:Invoke。

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": [ 
     "execute-api:Invoke"   
     ], 
     "Resource": [ 
     "arn:aws:execute-api:us-east-1:<account>:<rest-api>/*/POST/graphql" 
     ] 
    } 
    ] 
} 

您可以从Web控制台的方法设置页面中获取确切的资源ARN。

Answer 2

即使在遵循所有我收到相同的错误后。原因是我在初始化apigClient时错过了“sessionToken”。

var apigClient = apigClientFactory.newClient({ 
accessKey: AWS.config.credentials.accessKeyId, //'ACCESS_KEY', 
secretKey: AWS.config.credentials.secretAccessKey, //'SECRET_KEY', 
sessionToken: AWS.config.credentials.sessionToken, // 'SESSION_TOKEN', //OPTIONAL: If you are using temporary credentials you must include the session token 
region: 'us-east-1' // OPTIONAL: The region where the API is deployed, by default this parameter is set to us-east-1 }); 

//可选：如果您正在使用临时凭证必须包括会话令牌 - 是不是真的可选