amazon-web-services - 具有 Lambda 集成的 Terraform API 网关

Question

几天前我开始使用 terraform，所以我是这个主题的初学者。我想创建一个 API 网关和一个带有层的 Lambda 作为自定义运行时来运行 R 脚本。这是我的 Terraform 文件:

lambda .tf

resource "aws_lambda_function" "testlambda" {
  function_name = "rlambda"

  s3_bucket = "mybucket"
  s3_key    = "rlambda/v1.0.3/rlambda.zip"
  handler = "main.main"
  runtime = "provided"
  memory_size = 512
  timeout = 30
  layers = [aws_lambda_layer_version.r_layer.arn]
  role = aws_iam_role.lambda_role.arn
}

# IAM role for lambda
resource "aws_iam_role" "lambda_role" {
  name = "lambda_role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

# Lambda Policy
resource "aws_lambda_permission" "apigw" {
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.testlambda.function_name
  principal     = "apigateway.amazonaws.com"

  source_arn = "${aws_api_gateway_rest_api.apigateway.execution_arn}/*/POST/dev"

  depends_on = [
    aws_api_gateway_rest_api.apigateway,
    aws_api_gateway_resource.apiresource,
  ]
  }

# Lambda Layer
resource "aws_lambda_layer_version" "r_layer" {
  layer_name = "rlayer"
  s3_bucket = "mybucket"
  s3_key = "lambdalayer/v1.0.3/rlayer.zip"
}

# Cloudwatch Logging for Lambda
resource "aws_iam_policy" "lambda_logging" {
  name = "lambda_logging"
  path = "/"
  description = "IAM policy for logging from a lambda"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*",
      "Effect": "Allow"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "lambda_logs" {
  role = aws_iam_role.lambda_role.name
  policy_arn = aws_iam_policy.lambda_logging.arn
}

api_gateway.tf

resource "aws_api_gateway_rest_api" "apigateway" {
  name        = "ApiGatewayTest"
  description = "Terraform Created Api Gateway"
  binary_media_types = ["multipart/form-data", "application/octet-stream"]
  }

resource "aws_api_gateway_resource" "apiresource" {
  rest_api_id = aws_api_gateway_rest_api.apigateway.id
  parent_id   = aws_api_gateway_rest_api.apigateway.root_resource_id
  path_part   = "dev"
}

# Method
resource "aws_api_gateway_method" "method" {
  rest_api_id   = aws_api_gateway_rest_api.apigateway.id
  resource_id   = aws_api_gateway_resource.apiresource.id
  http_method   = "POST"
  authorization = "NONE"
}

# Integration
resource "aws_api_gateway_integration" "integration" {
  rest_api_id = aws_api_gateway_rest_api.apigateway.id
  resource_id = aws_api_gateway_method.method.resource_id
  http_method = aws_api_gateway_method.method.http_method

  integration_http_method = "POST"
  type                    = "AWS"
  uri                     = aws_lambda_function.testlambda.invoke_arn
  passthrough_behavior = "WHEN_NO_TEMPLATES"
  request_templates = {
    "multipart/form-data" = file("api_gateway_body_mapping.template")
  }
  depends_on = [aws_api_gateway_method.method]
}

# Method Response
resource "aws_api_gateway_method_response" "methodresponse" {
  rest_api_id = aws_api_gateway_rest_api.apigateway.id
  resource_id = aws_api_gateway_resource.apiresource.id
  http_method = aws_api_gateway_method.method.http_method
  status_code = "200"
  response_parameters = {
        "method.response.header.Access-Control-Allow-Origin" = true,
        "method.response.header.Access-Control-Expose-Headers" = true,
        "method.response.header.Content-Disposition" = true,
        "method.response.header.Content-Type" = true
  }
}

# Integration Response
resource "aws_api_gateway_integration_response" "integrationresponse" {
  rest_api_id = aws_api_gateway_rest_api.apigateway.id
  resource_id = aws_api_gateway_resource.apiresource.id
  http_method = aws_api_gateway_method.method.http_method
  status_code = aws_api_gateway_method_response.methodresponse.status_code
  content_handling = "CONVERT_TO_BINARY"
  response_parameters = {
        "method.response.header.Access-Control-Allow-Origin" = "'*'",
        "method.response.header.Access-Control-Expose-Headers" = "'Content-Disposition'",
        "method.response.header.Content-Disposition" = "'attachment'",
        "method.response.header.Content-Type" = "'application/octet-stream'"
  }
  depends_on = [aws_api_gateway_integration.integration]
}

# CORS Method
resource "aws_api_gateway_method" "cors_method" {
    rest_api_id   = aws_api_gateway_rest_api.apigateway.id
    resource_id   = aws_api_gateway_resource.apiresource.id
    http_method   = "OPTIONS"
    authorization = "NONE"
}

# CORS Integration
resource "aws_api_gateway_integration" "cors_integration" {
    rest_api_id   = aws_api_gateway_rest_api.apigateway.id
    resource_id   = aws_api_gateway_resource.apiresource.id
    http_method   = aws_api_gateway_method.cors_method.http_method
    type          = "MOCK"
    request_templates = {
    "application/json" = <<EOF
{"statusCode": 200}
EOF
    }
    depends_on = [aws_api_gateway_method.cors_method]
}

# CORS Method Response
resource "aws_api_gateway_method_response" "cors_methodresponse" {
    rest_api_id   = aws_api_gateway_rest_api.apigateway.id
    resource_id   = aws_api_gateway_resource.apiresource.id
    http_method   = aws_api_gateway_method.cors_method.http_method
    status_code   = "200"
    response_models = {
        "application/json" = "Empty"
    }
    response_parameters = {
        "method.response.header.Access-Control-Allow-Headers" = true,
        "method.response.header.Access-Control-Allow-Methods" = true,
        "method.response.header.Access-Control-Allow-Origin" = true
    }
    depends_on = [aws_api_gateway_method.cors_method]
}

# CORS Integration Response
resource "aws_api_gateway_integration_response" "cors_integrationresponse" {
    rest_api_id   = aws_api_gateway_rest_api.apigateway.id
    resource_id   = aws_api_gateway_resource.apiresource.id
    http_method   = aws_api_gateway_method.cors_method.http_method
    status_code   = aws_api_gateway_method_response.cors_methodresponse.status_code
    response_parameters = {
        "method.response.header.Access-Control-Allow-Headers" = "'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'",
        "method.response.header.Access-Control-Allow-Methods" = "'OPTIONS,POST'",
        "method.response.header.Access-Control-Allow-Origin" = "'*'"
    }
    response_templates = {
      "application/json" = <<EOF
EOF
    }
    depends_on = [
      aws_api_gateway_method_response.cors_methodresponse,
      aws_api_gateway_integration.cors_integration,
    ]
}

# Deployment
resource "aws_api_gateway_deployment" "apideployment" {
  depends_on = [
    aws_api_gateway_integration.integration,
    aws_api_gateway_integration.cors_integration
  ]

  rest_api_id = aws_api_gateway_rest_api.apigateway.id
  stage_name  = "dev"
}

output "base_url" {
  value = aws_api_gateway_deployment.apideployment.invoke_url
}

api_gateway_body_mapping.template

{
    "body": "$input.body",
    "headers": {
        #foreach($param in $input.params().header.keySet())
        "$param": "$util.escapeJavaScript($input.params().header.get($param))"
        #if($foreach.hasNext),#end
        #end
    }
}

因此 terraform init 和 apply 完成，但 API 网关显示内部服务器错误。 (从 postman 那里调用它，使用这个 url:https://(randomchars).execute-api.eu-central-1.amazonaws.com/dev/dev)

“由于配置错误导致执行失败:无法转换请求”- 这是来自 api 的 cloudwatch 日志的错误。

如果我转到 AWS 控制台上执行 POST 方法的集成请求，并重新添加函数名称 (rlambda)，它会向 lambda 添加另一个策略(与之前完全相同，具有不同的 Sid当然)然后我重新部署我的 API，然后它就可以完全工作了。 (如果我只执行部署 API 部分，它不起作用。)

所以我的问题是:

• 当我重新添加我的函数名称时，后台是否发生了什么？ (政策事项除外)
• 要在我的代码中更改什么才能在 Terraform 应用后立即调用 api 网关？

Answer 1

好吧，经过 5 天的痛苦，我意识到问题出在哪里。

在 AWS 控制台上，您无法设置集成请求的content_handling，它在 Terraform 中也只是一个可选参数。

当您在控制台上重新分配 lambda 的名称时，不仅 lambda 的策略得到更新，而且集成请求的 content_handling 也设置为 CONVERT_TO_TEXT。我不知道它为什么会改变，为什么会变成这个值。也许它基于 lambda - 没有关于此的信息。

所以我将这一行添加到 aws_api_gateway_integration:

content_handling = "CONVERT_TO_TEXT"

它解决了我的问题。 希望没有人会再次遇到这种情况。