英文:
How do you access an AWS Lambda with credentials using API Gateway?
问题
我不清楚如何将凭证和IAM访问权限发送到API网关。这一点似乎很清楚：
AWS上有一个教程，但这不是我想要访问我的API的方式。
API网关示例
正如大多数人所知，您将AWS密钥和秘密密钥放入一个配置文件中，该文件位于用户空间中的用户的.AWS目录下，但是如果您正在使用网站，例如，您将无法这样做。是否有一种想法，每当用户访问API时，您将该用户放入一个具有访问.credentials文件权限的匿名组中？
英文:
I'm not clear on how to send credentials and IAM access to an API gateway. This seems clear:
There is the tutorial on AWS but this is not the way I wanted to access my API.
API Gateway example
As most would know, you put your AWS Key and Secret key in a configuration file that lives in .AWS on the userspace of the user but if you are using a website, for example, you won't have that. Is the idea that anytime a user access the API that you put that user in an anonymous group that has access to the .credentials file?
答案1
得分: 1
你正在描述API网关的IAM身份验证。为了使你的Web应用生成IAM凭证，我建议使用Cognito身份池身份验证角色。Cognito身份池身份验证角色会交换JWT以获取用于API调用的AWS IAM凭证。你的用户首先会对身份池进行身份验证。身份池甚至允许未经身份验证的用户（使用你注册的应用程序）生成带有你指定权限的凭证。这个指南将向你展示如何在你的代码中生成这些凭证。
或者，你可以使用API网关身份池授权程序或API网关Lambda授权程序来保护你的API。
英文:
You are describing IAM authentication for API Gateways. For your of your web app to generate IAM credentials I would recommend using a Cognito Identity Pool Authenticated Role. The Cognito Identity Pool Authenticated Role Exchanges a JWT for the AWS IAM credentialsthat are used in API calls. Your users will first authenticate against the identity pool. The identity pool even allows for unauthenticated users that are using your registered app to generate credentials with permissions which you specify. This guide will show you how to generate these credentials in your code.
Alternatively you can use API Gateway Identity Pool Authorizer or API Gateway Lambda Authorizer to secure your API.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论