amazon-web-services - 使用 LambdaIntegration 时 CDK 覆盖绑定(bind)

Question

当使用 LambdaIntegration 类时，绑定(bind)函数会自动向 lambda 添加权限:

    bind(method) {
        super.bind(method);
        const principal = new iam.ServicePrincipal('apigateway.amazonaws.com');
        const desc = `${method.restApi.node.uniqueId}.${method.httpMethod}.${method.resource.path.replace(/\//g, '.')}`;
        this.handler.addPermission(`ApiPermission.${desc}`, {
            principal,
            scope: method,
            sourceArn: method.methodArn,
        });
        // add permission to invoke from the console
        if (this.enableTest) {
            this.handler.addPermission(`ApiPermission.Test.${desc}`, {
                principal,
                scope: method,
                sourceArn: method.testMethodArn,
            });
        }
    }

目前，我创建了多个 API 网关，其中 90% 触发了相同的 lambda 函数，这导致我出现以下错误:

The final policy size (XXX) is bigger than the limit (20480)

更多信息 here .

我的目标是用我自己的函数覆盖绑定(bind)函数并自己处理权限，类似这样:

arn:aws:execute-api:{AWS_REGION}:{AWS_ACCOUNT}:{API_ID}/*/*/*

我知道这不是最佳做法，但目前这是唯一可行的解​​决方法。

这是我创建的新类:

    class customLambdaIntegration extends apigateway.LambdaIntegration{
          myHandler: lambda.IFunction;
          constructor(handler: lambda.IFunction, options?: LambdaIntegrationOptions) {
            super(handler, options);
            this.myHandler = handler;
          }
          bind(method: Method) {
            const principal = new iam.ServicePrincipal('apigateway.amazonaws.com');
            const desc = `${method.restApi.node.uniqueId}.${method.httpMethod}.${method.resource.path.replace(/\//g, '.')}`;
            this.myHandler.addPermission(`ApiPermission.${desc}`, {
              principal,
              scope: method,
              sourceArn: method.methodArn.toString().replace(api.deploymentStage.stageName,'*')
            });
          }
        }

运行 cdk list 时出现此错误:

if (!this.scope) { throw new Error('AwsIntegration must be used in API'); }

引发错误的有问题的代码段:

    class AwsIntegration extends integration_1.Integration {
        constructor(props) {
            const backend = props.subdomain ? `${props.subdomain}.${props.service}` : props.service;
            const type = props.proxy ? integration_1.IntegrationType.AWS_PROXY : integration_1.IntegrationType.AWS;
            const { apiType, apiValue } = util_1.parseAwsApiCall(props.path, props.action, props.actionParameters);
            super({
                type,
                integrationHttpMethod: props.integrationHttpMethod || 'POST',
                uri: cdk.Lazy.stringValue({ produce: () => {
                        if (!this.scope) {
                            throw new Error('AwsIntegration must be used in API');
                        }
                        return cdk.Stack.of(this.scope).formatArn({
                            service: 'apigateway',
                            account: backend,
                            resource: apiType,
                            sep: '/',
                            resourceName: apiValue,
                        });
                    } }),
                options: props.options,
            });
        }
        bind(method) {
            this.scope = method;
        }
    }

LambdaIntegration documentation.

任何帮助将不胜感激。

---

这可能对谁有帮助，我打开一个功能请求来实现我的功能并手动处理 lambda 权限:

https://github.com/aws/aws-cdk/issues/5774

Answer 1

发现问题，this['scope'] = method; 在绑定(bind)函数中丢失，因为 AwsIntegration 类实现了 this.scope=method.

完整代码:

       class customLambdaIntegration extends apigateway.LambdaIntegration{
          // myScope : cdk.IConstruct;
          myHandler: lambda.IFunction;
          MyOptinos: apigateway.LambdaIntegrationOptions | undefined;
          constructor(handler: lambda.IFunction, options?: LambdaIntegrationOptions) {
            super(handler, options);
            this.myHandler = handler;
            this.MyOptinos = options;
          }
          bind(method: Method) {
            this['scope'] = method;
            const principal = new iam.ServicePrincipal('apigateway.amazonaws.com');
            const desc = `${method.restApi.node.uniqueId}.${method.httpMethod}.${method.resource.path.replace(/\//g, '.')}`;
            this.myHandler.addPermission(`ApiPermission.${desc}`, {
              principal,
              scope: method,
              sourceArn: method.methodArn.toString().replace(api.deploymentStage.stageName,'*')
            });
        }
      }