java - 发出外部 HTTPS 请求时 AWS Lambda 超时

Question

我需要在我的 AWS Lambda 项目中使用 Firebase Admin Java，但 Firebase Auth Admin 抛出 SocketTimeoutException当它尝试在 Google 服务器中获取公钥时。我知道 Firebase Admin 配置正确，因为我可以在 Tomcat 实例中本地运行它，无需担心。

然后我尝试向测试 API 发出 HTTPS 请求，例如 https://postman-echo.com/get?foo1=bar1&foo2=bar2 ，并且它具有相同的行为，我也遇到超时，这让我认为这是 Lambda 调用 HTTPS 请求的问题。

现在我所知道的是:

1. 我的 lambda 已与 API 网关集成
2. 我的 lambda 位于可通过互联网网关访问互联网的子网内
3. 我的 lambda 安全组完全开放
4. 我知道此问题发生在 HTTPS 请求上，但我不确定纯 HTTP。这很难测试，因为我找不到不会自动从 HTTP 重定向到 HTTPS 的 API，而且我现在无法推出自己的 API。

为了完整起见，我将在这里保留 SocketTimeoutException我从 Firebase Admin Java 获取信息，尽管我还不确定这是否是 Firebase Admin 库中的问题、AWS Lambda + HTTPS 的问题或两者兼而有之:

[main] ERROR com.example.project.filters.FirebaseAuthenticationFilter - Error while parsing or validating the token com.google.firebase.auth.FirebaseAuthException: Error while verifying signature. at com.google.firebase.auth.FirebaseTokenVerifierImpl.checkSignature(FirebaseTokenVerifierImpl.java:160) at com.google.firebase.auth.FirebaseTokenVerifierImpl.verifyToken(FirebaseTokenVerifierImpl.java:92) at com.google.firebase.auth.FirebaseAuth$4.execute(FirebaseAuth.java:426) at com.google.firebase.auth.FirebaseAuth$4.execute(FirebaseAuth.java:423) at com.google.firebase.internal.CallableOperation.call(CallableOperation.java:36) at com.google.firebase.auth.FirebaseAuth.verifyIdToken(FirebaseAuth.java:388) at com.google.firebase.auth.FirebaseAuth.verifyIdToken(FirebaseAuth.java:362) at com.example.project.filters.FirebaseAuthenticationFilter.filter(FirebaseAuthenticationFilter.java:55) at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:132) at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:68) at org.glassfish.jersey.process.internal.Stages.process(Stages.java:197) at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:269) at org.glassfish.jersey.internal.Errors$1.call(Errors.java:272) at org.glassfish.jersey.internal.Errors$1.call(Errors.java:268) at org.glassfish.jersey.internal.Errors.process(Errors.java:316) at org.glassfish.jersey.internal.Errors.process(Errors.java:298) at org.glassfish.jersey.internal.Errors.process(Errors.java:268) at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:289) at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:256) at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:703) at com.amazonaws.serverless.proxy.jersey.JerseyHandlerFilter.doFilter(JerseyHandlerFilter.java:91) at com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder.doFilter(FilterChainHolder.java:84) at com.amazonaws.serverless.proxy.internal.servlet.AwsLambdaServletContainerHandler.doFilter(AwsLambdaServletContainerHandler.java:206) at com.amazonaws.serverless.proxy.jersey.JerseyLambdaContainerHandler.handleRequest(JerseyLambdaContainerHandler.java:184) at com.amazonaws.serverless.proxy.jersey.JerseyLambdaContainerHandler.handleRequest(JerseyLambdaContainerHandler.java:76) at com.amazonaws.serverless.proxy.internal.LambdaContainerHandler.proxy(LambdaContainerHandler.java:177) at com.amazonaws.serverless.proxy.internal.LambdaContainerHandler.proxyStream(LambdaContainerHandler.java:209) at com.example.project.StreamLambdaHandler.handleRequest(StreamLambdaHandler.java:39) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at lambdainternal.EventHandlerLoader$StreamMethodRequestHandler.handleRequest(EventHandlerLoader.java:350) at lambdainternal.EventHandlerLoader$2.call(EventHandlerLoader.java:888) at lambdainternal.AWSLambda.startRuntime(AWSLambda.java:293) at lambdainternal.AWSLambda.(AWSLambda.java:64) at java.lang.Class.forName0(Native Method) at java.lang.Class.forName(Class.java:348) at lambdainternal.LambdaRTEntry.main(LambdaRTEntry.java:114) Caused by: java.net.SocketTimeoutException: connect timed out at java.net.PlainSocketImpl.socketConnect(Native Method) at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) at java.net.Socket.connect(Socket.java:589) at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:666) at sun.net.NetworkClient.doConnect(NetworkClient.java:175) at sun.net.www.http.HttpClient.openServer(HttpClient.java:463) at sun.net.www.http.HttpClient.openServer(HttpClient.java:558) at sun.net.www.protocol.https.HttpsClient.(HttpsClient.java:264) at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191) at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1156) at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1050) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177) at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:162) at com.google.api.client.http.javanet.NetHttpRequest.execute(NetHttpRequest.java:104) at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:981) at com.google.api.client.googleapis.auth.oauth2.GooglePublicKeysManager.refresh(GooglePublicKeysManager.java:172) at com.google.api.client.googleapis.auth.oauth2.GooglePublicKeysManager.getPublicKeys(GooglePublicKeysManager.java:140) at com.google.firebase.auth.FirebaseTokenVerifierImpl.isSignatureValid(FirebaseTokenVerifierImpl.java:226) at com.google.firebase.auth.FirebaseTokenVerifierImpl.checkSignature(FirebaseTokenVerifierImpl.java:152) ... 38 more

Answer 1

My lambda is inside a subnet with internet access through an Internet Gateway

单独的互联网网关不会提供驻留在 VPC 中的 Lambda 函数对互联网的访问。这是因为 VPC 内的 Lambda 函数不接收公共(public) IP 地址。您必须使用 NAT 网关为 VPC 内的 Lambda 函数提供 Internet 访问。