要使用AWS CDK创建包含RestAPI、Cognito和IAM授权的解决方案,可以按照以下步骤操作:
npm install -g aws-cdk
mkdir my-cdk-project
cd my-cdk-project
cdk init app --language typescript
npm install @aws-cdk/aws-apigateway @aws-cdk/aws-cognito @aws-cdk/aws-iam
lib
文件夹中创建一个新的RestApiCognitoStack.ts
文件,并将以下代码添加到该文件中:import * as cdk from '@aws-cdk/core';
import * as apigateway from '@aws-cdk/aws-apigateway';
import * as cognito from '@aws-cdk/aws-cognito';
import * as iam from '@aws-cdk/aws-iam';
export class RestApiCognitoStack extends cdk.Stack {
constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// 创建一个Cognito User Pool
const userPool = new cognito.UserPool(this, 'MyUserPool', {
selfSignUpEnabled: true,
signInAliases: {
email: true
},
autoVerify: {
email: true
}
});
// 创建一个Cognito User Pool Client
const userPoolClient = new cognito.UserPoolClient(this, 'MyUserPoolClient', {
userPool
});
// 创建一个API Gateway Rest API
const restApi = new apigateway.RestApi(this, 'MyRestApi', {
defaultCorsPreflightOptions: {
allowOrigins: apigateway.Cors.ALL_ORIGINS,
allowMethods: apigateway.Cors.ALL_METHODS
}
});
// 创建一个API Gateway Authorizer
const authorizer = new apigateway.CognitoUserPoolsAuthorizer(this, 'MyAuthorizer', {
cognitoUserPools: [userPool]
});
// 创建一个API Gateway Resource
const resource = restApi.root.addResource('myresource');
// 创建一个API Gateway Method,并使用Cognito授权
resource.addMethod('GET', new apigateway.HttpIntegration('http://example.com'), {
authorizer
});
// 创建一个IAM Role,并为Cognito User Pool Client分配权限
const role = new iam.Role(this, 'MyRole', {
assumedBy: new iam.FederatedPrincipal('cognito-identity.amazonaws.com', {
StringEquals: {
'cognito-identity.amazonaws.com:aud': userPoolClient.userPoolClientId
},
'ForAnyValue:StringLike': {
'cognito-identity.amazonaws.com:amr': 'authenticated'
}
}, 'sts:AssumeRoleWithWebIdentity')
});
role.addToPolicy(new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['execute-api:Invoke'],
resources: [resource.resourceArn]
}));
}
}
bin
文件夹中的my-cdk-project.ts
文件中,将以下代码添加到文件的顶部,以导入新创建的RestApiCognitoStack
:import { RestApiCognitoStack } from '../lib/RestApiCognitoStack';
bin
文件夹中的my-cdk-project.ts
文件中,将以下代码替换为main
函数,以使用新创建的RestApiCognitoStack
:const app = new cdk.App();
new RestApiCognitoStack(app, 'MyRestApiCognitoStack');
app.synth();