为 Amazon MQ for RabbitMQ 使用 OAuth 2.0 认证与授权

使用 create-configuration Amazon CLI 命令创建新配置，如下例所示。

aws mq create-configuration \
  --name "rabbitmq-oauth2-config" \
  --engine-type "RABBITMQ" \
  --engine-version "3.13"

此命令返回类似于以下示例的响应。

{
    "Arn": "arn:aws:mq:us-west-2:123456789012:configuration:c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca",
    "AuthenticationStrategy": "simple",
    "Created": "2025-07-17T16:03:01.759943+00:00",
    "Id": "c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca",
    "LatestRevision": {
    "Created": "2025-07-17T16:03:01.759000+00:00",
    "Description": "Auto-generated default for rabbitmq-oauth2-config on RabbitMQ 3.13",
    "Revision": 1
    },
    "Name": "rabbitmq-oauth2-config"
}

创建一个名为 rabbitmq.conf 的配置文件以使用 OAuth 2.0 作为认证与授权方法，如下例所示。

auth_backends.1 = oauth2

# FIXME: Update this value with the token signing key URL of your Amazon Cognito user pool.
# If you used the Amazon CDK stack to deploy Amazon Cognito, this is one of the stack outputs.
auth_oauth2.jwks_url = ${RabbitMqOAuth2TestStack.JwksUri}
auth_oauth2.resource_server_id = rabbitmq
# Amazon Cognito does not include an audience field in access tokens
auth_oauth2.verify_aud = false 

# Amazon Cognito does not allow * in its custom scopes. Use aliases to translate between Amazon Cognito and RabbitMQ.
auth_oauth2.scope_prefix = rabbitmq/
auth_oauth2.scope_aliases.1.alias = rabbitmq/read:all
auth_oauth2.scope_aliases.1.scope = rabbitmq/read:*/*
auth_oauth2.scope_aliases.2.alias = rabbitmq/write:all
auth_oauth2.scope_aliases.2.scope = rabbitmq/write:*/*
auth_oauth2.scope_aliases.3.alias = rabbitmq/configure:all
auth_oauth2.scope_aliases.3.scope = rabbitmq/configure:*/*

# Allow OAuth 2.0 login for RabbitMQ management console
management.oauth_enabled = true
# FIXME: Update this value with the client ID of your public application client
management.oauth_client_id = ${RabbitMqOAuth2TestStack.ManagementConsoleAppClientId}
# FIXME: Update this value with the base JWKS URI (without /.well-known/jwks.json)
auth_oauth2.issuer = ${RabbitMqOAuth2TestStack.Issuer}
management.oauth_scopes = rabbitmq/tag:administrator

此配置使用范围别名将 Amazon Cognito 中定义的范围映射到 RabbitMQ 兼容范围。

使用 update-configuration Amazon CLI 命令更新配置，如下例所示。在此命令中，添加您在本过程步骤 1 的响应中收到的配置 ID。例如 c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca。

aws mq update-configuration \
  --configuration-id "<c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca>" \
  --data "$(cat rabbitmq.conf | base64 --wrap=0)"

此命令返回类似于以下示例的响应。

{
    "Arn": "arn:aws:mq:us-west-2:123456789012:configuration:c-b600ac8e-8183-4f74-a713-983e59f30e3d",
    "Created": "2025-07-17T16:57:04.520931+00:00",
    "Id": "c-b600ac8e-8183-4f74-a713-983e59f30e3d",
    "LatestRevision": {
        "Created": "2025-07-17T16:57:39.172000+00:00",
        "Revision": 2
    },
    "Name": "rabbitmq-oauth2-config",
    "Warnings": []
}

使用您在本过程步骤 2 中创建的 OAuth 2.0 配置创建代理。要执行此操作，请使用 create-broker Amazon CLI 命令，如下例所示。在此命令中，分别提供您在步骤 1 和步骤 2 的响应中获得的配置 ID 和修订号。例如，c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca 和 2。

aws mq create-broker \
 --broker-name "rabbitmq-oauth2-broker" \ 
 --engine-type "RABBITMQ" \
 --engine-version "3.13" \
 --host-instance-type "mq.m7g.large" \
 --deployment-mode "CLUSTER_MULTI_AZ" \
 --logs '{"General": true}' \
 --publicly-accessible \
 --configuration '{"Id": "<c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca>","Revision": <2>}' \

此命令返回类似于以下示例的响应。

{
    "BrokerArn": "arn:aws:mq:us-west-2:123456789012:broker:rabbitmq-oauth2-broker:b-2a1b5133-a10c-49d2-879b-8c176c34cf73",
    "BrokerId": "b-2a1b5133-a10c-49d2-879b-8c176c34cf73"
}

使用 describe-broker Amazon CLI 命令验证代理状态是否从 CREATION_IN_PROGRESS 转换为 RUNNING，如下例所示。在此命令中，提供您在上一步结果中获得的代理 ID，例如 b-2a1b5133-a10c-49d2-879b-8c176c34cf73。

aws mq describe-broker \
 --broker-id "<b-2a1b5133-a10c-49d2-879b-8c176c34cf73>"

此命令返回类似于以下示例的响应。以下响应是 describe-broker 命令返回的完整输出的缩写版本。此响应显示代理状态以及用于保护代理的认证策略。在此情况下，config_managed 认证策略表明代理使用 OAuth 2 认证方法。

{
    "AuthenticationStrategy": "config_managed",
    ...,
    "BrokerState": "RUNNING",
    ...
}

要使用 OAuth2 登录 RabbitMQ 管理控制台，需要将代理端点作为有效回调 URL 添加到相应的 Amazon Cognito 应用程序客户端中。更多信息，请参阅我们的示例 Amazon Cognito CDK 堆栈设置中的步骤 5。

使用以下 perf-test.sh 脚本验证 OAuth 2.0 认证与授权。

使用此 bash 脚本测试与您的 Amazon MQ for RabbitMQ 代理的连接性。该脚本从 Amazon Cognito 获取令牌并验证连接是否配置正确。如果配置成功，您将看到代理发布和消费消息。

如果收到 ACCESS_REFUSED 错误，可以使用代理的 CloudWatch 日志对配置设置进行故障排除。您可以在 Amazon MQ 控制台中找到代理的 CloudWatch 日志组链接。

在此脚本中，您需要提供以下值：

#! /bin/bash
set -e

# Client information
## FIXME: Update this value with the client ID and secret of your confidential application client
CLIENT_ID=${RabbitMqOAuth2TestStack.AmqpAppClientId}
CLIENT_SECRET=${RabbitMqOAuth2TestStack.AmqpAppClientSecret}

# FIXME: Update this value with the domain of your Amazon Cognito user pool
RESPONSE=$(curl -X POST ${RabbitMqOAuth2TestStack.TokenEndpoint} \
                -H "Content-Type: application/x-www-form-urlencoded" \
                -d "grant_type=client_credentials&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&scope=rabbitmq/configure:all rabbitmq/read:all rabbitmq/tag:administrator rabbitmq/write:all")


# Extract the access_token from the response.
# This token will be passed in the password field when connecting to the broker.
# Note that the username is left blank, the field is ignored by the plugin.
BROKER_PASSWORD=$(echo ${RESPONSE} | jq -r '.access_token')

# FIXME: Update this value with the endpoint of your broker. For example, b-89424106-7e0e-4abe-8e98-8de0dada7630.mq.us-east-1.on.aws.
BROKER_DNS=<broker_dns>
CONNECTION_STRING=amqps://:${BROKER_PASSWORD}@${BROKER_DNS}:5671 

# Produce/consume messages using the above connection string
QUEUES_COUNT=1
PRODUCERS_COUNT=1
CONSUMERS_COUNT=1
PRODUCER_RATE=1

docker run -it --rm --ulimit nofile=40960:40960 pivotalrabbitmq/perf-test:latest \
    --queue-pattern 'test-queue-%d' --queue-pattern-from 1 --queue-pattern-to $QUEUES_COUNT \
    --producers $PRODUCERS_COUNT --consumers $CONSUMERS_COUNT \
    --id "test${QUEUES_COUNT}q${PRODUCERS_COUNT}p${CONSUMERS_COUNT}c${PRODUCER_RATE}r" \
    --uri ${CONNECTION_STRING} \
    --flag persistent --rate $PRODUCER_RATE

要同时使用两种认证方法，请创建代理配置，如下例所示。

auth_backends.1 = oauth2
auth_backends.2 = internal

# FIXME: Update this value with the token signing key URL of your Amazon Cognito user pool
auth_oauth2.jwks_url = ${RabbitMqOAuth2TestStack.JwksUri}
auth_oauth2.resource_server_id = rabbitmq
auth_oauth2.verify_aud = false

auth_oauth2.scope_prefix = rabbitmq/
auth_oauth2.scope_aliases.1.alias = rabbitmq/read:all
auth_oauth2.scope_aliases.1.scope = rabbitmq/read:*/*
auth_oauth2.scope_aliases.2.alias = rabbitmq/write:all
auth_oauth2.scope_aliases.2.scope = rabbitmq/write:*/*
auth_oauth2.scope_aliases.3.alias = rabbitmq/configure:all
auth_oauth2.scope_aliases.3.scope = rabbitmq/configure:*/*

此配置使用范围别名将 Amazon Cognito 中定义的范围映射到 RabbitMQ 兼容范围。

创建同时使用两种认证方法的代理，如下例所示。

aws mq create-broker \
 --broker-name "rabbitmq-oauth2-broker-with-internal-user" \
 --engine-type "RABBITMQ" \
 --engine-version "3.13" \
 --host-instance-type "mq.m7g.large" \
 --deployment-mode "CLUSTER_MULTI_AZ" \
 --logs '{"General": true}' \
 --publicly-accessible \
 --configuration '{"Id": "<ConfigurationId>","Revision": <Revision>}' \
 --users '[{"Username":"<myUser>","Password":"<myPassword11>"}]'

按照 配置与 Amazon Cognito 的 OAuth 2.0 认证 过程中步骤 5 和 6 所述，验证代理状态和认证方法设置配置是否成功。