Amazon API Gateway
开发人员指南
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

x-amazon-apigateway-authorizer 对象

定义 Lambda 授权方(以前称为自定义授权方),用于 API Gateway 中的方法调用授权。此对象是 OpenAPI 安全定义对象的扩展属性。

属性

属性名称 类型 描述
type string

授权方的类型。这是一个必需属性。为具有已嵌入授权令牌中的调用方身份的授权方指定 "token"。为具有请求参数中包含的调用方身份的授权方指定 "request"

authorizerUri string

授权方 Lambda 函数的统一资源标识符 (URI)。语法如下:

"arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:account-id:function:auth_function_name/invocations"
authorizerCredentials string

调用授权方所需的凭证 (如果有),该凭证采用 IAM 执行角色的 ARN 形式。例如,“arn:aws:iam::account-id:IAM_role”。

identitySource string

请求参数 (作为身份来源) 的映射表达式的逗号分隔列表。仅适用于“request”类型的授权方。

identityValidationExpression string

一个正则表达式,用于验证作为传入身份的令牌。例如,“^x-[a-z]+”。

authorizerResultTtlInSeconds string

秒数;在此期间缓存生成的 IAM 策略。

x-amazon-apigateway-authorizer 示例

以下 OpenAPI 安全定义示例指定了一个名为 test-authorizer 的“token”类型的 Lambda 授权方。

"securityDefinitions" : { "test-authorizer" : { "type" : "apiKey", // Required and the value must be "apiKey" for an API Gateway API. "name" : "Authorization", // The name of the header containing the authorization token. "in" : "header", // Required and the value must be "header" for an API Gateway API. "x-amazon-apigateway-authtype" : "oauth2", // Specifies the authorization mechanism for the client. "x-amazon-apigateway-authorizer" : { // An API Gateway Lambda authorizer definition "type" : "token", // Required property and the value must "token" "authorizerUri" : "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:account-id:function:function-name/invocations", "authorizerCredentials" : "arn:aws:iam::account-id:role", "identityValidationExpression" : "^x-[a-z]+", "authorizerResultTtlInSeconds" : 60 } } }

以下 OpenAPI 操作对象代码段设置 GET /http 来使用上述指定的 Lambda 授权方。

"/http" : { "get" : { "responses" : { }, "security" : [ { "test-authorizer" : [ ] } ], "x-amazon-apigateway-integration" : { "type" : "http", "responses" : { "default" : { "statusCode" : "200" } }, "httpMethod" : "GET", "uri" : "http://api.example.com" } } }

以下 OpenAPI 安全定义示例指定“request”类型的 Lambda 授权方作为身份来源,带单个标头参数 (auth)。securityDefinitions 名为 request_authorizer_single_header

"securityDefinitions": { "request_authorizer_single_header" : { "type" : "apiKey", "name" : "auth", // The name of a single header or query parameter as the identity source. "in" : "header", // The location of the single identity source request parameter. The valid value is "header" or "query" "x-amazon-apigateway-authtype" : "custom", "x-amazon-apigateway-authorizer" : { "type" : "request", "identitySource" : "method.request.header.auth", // Reqeust parameter mapping expression of the identity source. In this example, it is the 'auth' header. "authorizerCredentials" : "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole", "authorizerUri" : "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations", "authorizerResultTtlInSeconds" : 300 } } }

以下 OpenAPI 安全定义示例指定“request”类型的 Lambda 授权方作为身份来源,带有一个标头 (HeaderAuth1) 和一个查询字符串参数 QueryString1

"securityDefinitions": { "request_authorizer_header_query" : { "type" : "apiKey", "name" : "Unused", // Must be "Unused" for multiple identity sources or non header or query type of request parameters. "in" : "header", // Must be "header" for multiple identity sources or non header or query type of request parameters. "x-amazon-apigateway-authtype" : "custom", "x-amazon-apigateway-authorizer" : { "type" : "request", "identitySource" : "method.request.header.HeaderAuth1, method.request.querystring.QueryString1", // Request parameter mapping expressions of the identity sources. "authorizerCredentials" : "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole", "authorizerUri" : "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations", "authorizerResultTtlInSeconds" : 300 } } }

以下 OpenAPI 安全定义示例指定“request”类型的 API Gateway Lambda 授权方作为身份来源,带单个阶段变量 (stage)。

"securityDefinitions": { "request_authorizer_single_stagevar" : { "type" : "apiKey", "name" : "Unused", // Must be "Unused", for multiple identity sources or non header or query type of request parameters. "in" : "header", // Must be "header", for multiple identity sources or non header or query type of request parameters. "x-amazon-apigateway-authtype" : "custom", "x-amazon-apigateway-authorizer" : { "type" : "request", "identitySource" : "stageVariables.stage", // Request parameter mapping expression of the identity source. In this example, it is the stage variable. "authorizerCredentials" : "arn:aws:iam::123456789012:role/AWSepIntegTest-CS-LambdaRole", "authorizerUri" : "arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:APIGateway-Request-Authorizer:vtwo/invocations", "authorizerResultTtlInSeconds" : 300 } } }