使用IAM角色auth类型从步骤函数中调用AWS API网关

发布于 2025-02-09 05:09:44 字数 1426 浏览 2 评论 0原文

我有使用情况，必须在其他AWS帐户中调用API GATWAY REST端点，他们给了我一个可以假设的角色，

我正在考虑两个选项：

生成Lambda的请求，并调用API
使用步骤函数以调用API

Q1。我个人认为选项2更好，但是您对第二

季度有何看法。我很难从步骤函数调用剩余端点以下是我的步骤函数定义

{
  "Comment": "A description of my state machine",
  "StartAt": "API Gateway Invoke",
  "States": {
    "API Gateway Invoke": {
      "Type": "Task",
      "Resource": "arn:aws:states:::apigateway:invoke",
      "Parameters": {
        "ApiEndpoint": "endpoint",
        "Method": "GET",
        "Path": "path",
        "AuthType": "IAM_ROLE"
      },
      "End": true
    }
  }
}

IAM角色信任关系

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "states.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

扮演角色

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "role_arn"
    }
}

策略在执行步骤函数时，我会在我获得此错误响应时

{
  "resourceType": "apigateway",
  "resource": "invoke",
  "error": "ApiGateway.403",
  "cause": {
    "Message": "User:rolearn/hUAiLwbfPOsSKqarBDcdelSpeGIbyiZA is not authorized to access this resource"
  }
}

，我尝试将完整的执行权限授予步骤函数，但是这无济于事我会受到任何帮助，将不胜感激

原文

I have use case where I have to invoke the api gatway rest endpoint in other aws account, they have given me a role to assume,

I am thinking of two options:

generate the request from the lambda and call the api
use step function to invoke the api

Q1. I personally think option 2 is better but what are your view on this

Q2. I have trouble invoking the rest endpoint from the step function here is my step function definition

{
  "Comment": "A description of my state machine",
  "StartAt": "API Gateway Invoke",
  "States": {
    "API Gateway Invoke": {
      "Type": "Task",
      "Resource": "arn:aws:states:::apigateway:invoke",
      "Parameters": {
        "ApiEndpoint": "endpoint",
        "Method": "GET",
        "Path": "path",
        "AuthType": "IAM_ROLE"
      },
      "End": true
    }
  }
}

IAM role trust relationships

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "states.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Policy to assume role

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "role_arn"
    }
}

when I execute the step function I get this error response

{
  "resourceType": "apigateway",
  "resource": "invoke",
  "error": "ApiGateway.403",
  "cause": {
    "Message": "User:rolearn/hUAiLwbfPOsSKqarBDcdelSpeGIbyiZA is not authorized to access this resource"
  }
}

I have tried giving the full execution invoke permission to the step function but it didn't help
I am stuck any help would be appreciated

分享到QQ

分享到微博