如何使不同的AWS API网关环境指向lambda函数的不同别名?

问题描述:

在我的AWS API Gateway API中,我设置了两个环境"dev"和"prod".对于名为"dev"和"prod"的AWS Lambda函数,我也有两个别名.现在,我想将API的"dev"环境指向函数的"dev"别名,并将"prod"环境指向函数的"prod"别名.

In my AWS API Gateway API, I've set up 2 environments, "dev" and "prod". I also have 2 aliases for an AWS lambda function named "dev" and "prod". Now, I'd like to point the "dev" environment of my API to the "dev" alias of my function, and the "prod" environment at the "prod" alias of my function.

我阅读了目前无法找到的教程,该教程在集成配置中可以以<functionName>:<alias>的形式指定该函数,因此我将集成设置为指向:SlackCommands:${stageVariables.lambdaAlias}

I read in a tutorial that I can't find anymore at the moment, that in the integration configuration, you can specify the function in the form <functionName>:<alias>, so I set up the integration to point at: SlackCommands:${stageVariables.lambdaAlias}.

我在API的prod环境中添加了一个名为lambdaAlias和值为"prod"的阶段变量,并在dev环境中添加了一个具有"dev"值的同名变量.但是,当我将APi切换为使用最新的部署时,该部署引入了从简单的lambda函数名称到名称到别名的更改,在调用API时,我在cloudWatch中看到此错误:

I added a stage variable with name lambdaAlias and value "prod" in the prod environment of the API, and a variable with the same name in the dev environment, with the "dev" value. But when I switch the APi to use the latest deployment, which introduces this change from a simple lambda function name to a name to an alias, I see this error in cloudWatch when calling the API:

由于配置错误,执行失败:Lambda函数的权限无效

Execution failed due to configuration error: Invalid permissions on Lambda function

这首先发生在prod和dev身上.然后,我发现每个别名都设置了lambda触发器.因此,我从$ LATEST版本中删除了我的API触发器,并将其添加到"prod"别名中: img src ="https://i.stack.imgur.com/AerdI.png" alt =">

This first happened for both prod and dev. Then, I found out that lambda triggers are set per alias. So I removed my API trigger from $LATEST version, and added it to the "prod" alias:

然后我转到"dev"别名,并想添加相同的触发器,但是由于某些原因,现在我不能从下拉列表中选择"dev"环境:

Then I went to the "dev" alias, and wanted to add the same trigger, but for some reason, now I can't choose the "dev" environment from the dropdown:

我假设这是因为awzs想要将集成设置为专门指向"dev"别名,但是集成已经存在.如果我了解AWS的文档,我需要做的是设置一个lambda策略,该策略授予我的API的开发"环境对此别名的访问权限,但是控制台只有查看功能策略"部分,似乎没有位置手动设置.

I'm assuming this is because awzs wants to set the integration to point to the "dev" alias specifically, but an integration already exists. If I understand AWS's documentaiton, what I'd need to do is set a lambda policy that grants the "dev" environment of my API access to this alias, but the console only has a "View function policy" section, seemingly with no place to manually set it.

那么我该如何设置我想要的方式?最好通过控制台,因为我不经常使用AWS,也不想安装CLI.

So how do I set this up the way I want? Preferrably through the console, since I don't work with AWS often, and don't want to install the CLI.

不幸的是,这是您需要使用CLI命令设置的权限.原因是当在函数名称中使用stage变量时,API Gateway无法推断授予权限所需的完整函数名称.

This is a permission you will need to set with a CLI command, unfortunately. The reason is that API Gateway has no way to infer the full function name needed to grant the permissions when you use a stage variable in the function name.

您将需要运行的示例命令如下所示:

The sample command you'll need to run will look something like the following:

$ aws lambda add-permission \
--function-name LambdaFunctionOverHttps \
--statement-id apigateway-test-2 \
--action lambda:InvokeFunction \
--principal apigateway.amazonaws.com \
--source-arn "arn:aws:execute-api:region:aws-acct-id:api-id/*/POST/DynamoDBManager"
--principal apigateway.amazonaws.com

有关更多详细信息,请参阅此文档:

See this doc for more details: http://docs.aws.amazon.com/lambda/latest/dg/with-on-demand-https-example-configure-event-source.html#with-on-demand-https-add-permission