如何解决当我尝试从客户端调用AWS Amplify时，AWS SAM API Gateway引发UnauthorizedException错误
我尝试在API网关上打开Cognito身份验证，但是当我从客户端调用端点时，总是在响应标头中得到带有x-amzn-errortype: UnauthorizedException的HTTP 401响应。它可以在我的本地计算机上运行，但是在我部署到AWS上之后无法运行。
在React客户端中，我基本上使用AWS Amplify进行默认设置（我使用withAuthenticator HOC和API.get发送请求）
我的AWS SAM template.yaml看起来像这样：
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Globals:
Function:
Timeout: 10
Api:
Cors: '*'
Parameters:
Environment:
Type: String
Description: Choose between local or AWS
AllowedValues:
- local
- aws
DDBTableName:
Type: String
Description: The name of the DynamoDB tablename
Resources:
###################
## Lambdas ##
###################
# lambda function to fetch data from dynamodb
GetWeeksFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: functions/get-data/
Handler: app.lambdaHandler
Runtime: nodejs12.x
FunctionName: GetWeeksFunction
Events:
GetDocument:
Type: Api
Properties:
Path: /data
Method: get
RestApiId: !Ref MyApi
Environment:
Variables:
Environment: !Ref Environment
DDBTableName: !Ref DDBTableName
Policies:
- Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:PutLogEvents
Resource: arn:aws:logs:*:*:*
- Effect: Allow
Action:
- dynamodb:scan
Resource: '*'
# API stage
MyApi:
Type: AWS::Serverless::Api
Properties:
StageName: v1
Cors:
AllowMethods: "'*'"
AllowHeaders: "'*'"
AllowOrigin: "'*'"
Auth:
DefaultAuthorizer: MyCognitoAuthorizer
AddDefaultAuthorizerToCorsPreflight: False
Authorizers:
MyCognitoAuthorizer:
UserPoolArn: !GetAtt CognitoUserPool.Arn
##########################
## DynamoDB Table ##
##########################
# DynamoDB table to store documentId,versionId and document location
DocumentTable:
Type: AWS::DynamoDB::Table
Properties:
AttributeDefinitions:
-
AttributeName: 'weekId'
AttributeType: 'N'
KeySchema:
-
AttributeName: 'weekId'
KeyType: 'HASH'
TableName: !Ref DDBTableName
ProvisionedThroughput:
ReadCapacityUnits: 5
WriteCapacityUnits: 5
##########################
## Static S3 webapp ##
##########################
S3Bucket:
Type: AWS::S3::Bucket
Properties:
AccessControl: PublicRead
WebsiteConfiguration:
IndexDocument: index.html
##########################
## Cognito ##
##########################
# Cognito - User pool
CognitoUserPool:
Type: AWS::Cognito::UserPool
Properties:
UserPoolName: my_cognito_user_pool
# Cognito - Client
CognitoUserPoolClient:
Type: AWS::Cognito::UserPoolClient
Properties:
ClientName: my_cognito_client
UserPoolId:
Ref: CognitoUserPool
# Cognito - Identity
CognitoIdentityPool:
Type: AWS::Cognito::IdentityPool
Properties:
IdentityPoolName: my_cognito_identity_pool
AllowUnauthenticatedIdentities: false
CognitoIdentityProviders:
- ClientId:
Ref: CognitoUserPoolClient
ProviderName:
Fn::GetAtt: [CognitoUserPool,ProviderName]
# Cognito roles
CognitoIdentityPoolRoles:
Type: AWS::Cognito::IdentityPoolRoleAttachment
Properties:
IdentityPoolId:
Ref: CognitoIdentityPool
Roles:
authenticated:
Fn::GetAtt: [CognitoAuthRole,Arn]
unauthenticated:
Fn::GetAtt: [CognitoUnauthRole,Arn]
CognitoAuthRole:
Type: AWS::IAM::Role
Properties:
RoleName: appAuthRole
Path: /
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Federated: "cognito-identity.amazonaws.com"
Action:
- "sts:AssumeRoleWithWebIdentity"
Condition:
StringEquals:
"cognito-identity.amazonaws.com:aud":
Ref: CognitoIdentityPool
"ForAnyValue:StringLike":
"cognito-identity.amazonaws.com:amr": authenticated
Policies:
- PolicyName: "CognitoAuthorizedPolicy"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Action:
- "mobileanalytics:PutEvents"
- "cognito-sync:*"
- "cognito-identity:*"
Resource: "*"
- Effect: "Allow"
Action:
- "execute-api:Invoke"
Resource: "*"
CognitoUnauthRole:
Type: AWS::IAM::Role
Properties:
RoleName: appUnauthRole
Path: /
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Principal:
Federated: "cognito-identity.amazonaws.com"
Action:
- "sts:AssumeRoleWithWebIdentity"
Condition:
StringEquals:
"cognito-identity.amazonaws.com:aud":
Ref: CognitoIdentityPool
"ForAnyValue:StringLike":
"cognito-identity.amazonaws.com:amr": unauthenticated
Policies:
- PolicyName: "CognitoUnauthorizedPolicy"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Action:
- "mobileanalytics:PutEvents"
- "cognito-sync:*"
- "cognito-identity:*"
Resource: "*"
Outputs:
GetDocumentApi:
Description: API Gateway endpoint URL to get data
Value: !Sub https://${MyApi}.execute-api.${AWS::Region}.amazonaws.com/v1/data
有人知道这里可能是什么问题吗？
版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。