AWS Api网关与S3集成的SAM模板作为AWS服务

Question

我正在编写SAM模板，我想创建一个API网关，路径如下：-

http:///userFlights/airlines/static/images/｛airlineName｝。

这应该能够从S3 bucket下载文件。｛airlineName｝的值可能类似于IndiGo.jpg.

我可以手动创建。然而，问题是我找不到SAM模板的适当文档。我需要使用SAM.自动化我的API网关

这些值如下：-集成类型-AWS服务

AWS地区-欧洲-3

AWS服务-简单存储服务(S3

Http方法-GET

路径覆盖-航空公司/静态/图像/｛airlineName｝

Answer 1

您必须使用定义API配置的SAM模板中的DefinitionBody来使用OpenAPI定义。请查看此处的S3代理示例。我已经用最简单和最小的Swagger定义构建了一个API，并通过SAM.进行部署

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS SAM template with a S3 integration
Resources:
ApiGatewayApi:
Type: AWS::Serverless::Api
Properties:
StageName: prod
DefinitionBody: {
"swagger": "2.0",
"info": {
"version": "1.0"
},
"paths": {
"/airlines/static/images/{airlineName}": {
"get": {
"produces": [
"application/json"
],
"responses": {
"200": {
"description": "200 response"
}
},
"x-amazon-apigateway-integration": {
"responses": {
"default": {
"statusCode": "200"
}
},
"credentials": "arn:aws:iam::{account-id}:role/{role-name}",
"uri": "arn:aws:apigateway:{aws-region}:s3:path/{bucket-name}",
"passthroughBehavior": "when_no_match",
"httpMethod": "GET",
"type": "aws"
}
}
}
}
}

Answer 2

这是一个完整的工作版本，包括角色。部署完成后，在AWS控制台的API网关转到阶段，单击GET，您将看到以下内容：https://12345hhhh.execute-api.eu-west-2.amazonaws.com/dev/｛文件夹｝/｛项目｝

将｛folder｝和｛item｝替换为S3文件夹名称和S3项目(对象((没有｛｝(，它应该会获取资源

openApi swagger文档是直接从AWS文档中获取的(为了简单起见，略有删减(，如果您需要具有附加功能的完整版本，请访问此处：https://docs.aws.amazon.com/apigateway/latest/developerguide/api-as-s3-proxy-export-swagger-with-extensions.html

您可能想要锁定bucket而不是"*"，并且此示例中不包含身份验证

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: AWS SAM template for AWS API Gateway with S3 proxy AWS integration
Resources:
# roles
s3AWSIntegrationExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service:
- apigateway.amazonaws.com
RoleName: s3AWSIntegrationExecutionRole
# policies
apiGatewayExecutionPolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: !Sub ${AWS::StackName}-apiGatewayExecutionPolicy
Roles:
- Ref: s3AWSIntegrationExecutionRole
PolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: Allow
Action:
- s3:GetObject
- s3:PutObject
- s3:ListBucket
Resource: '*'
-
Effect: Allow
Action:
- logs:CreateLogGroup
- logs:CreateLogStream
- logs:DescribeLogStreams
- logs:PutLogEvents
Resource: '*'
# API Gateway
ApiGatewayApi:
Type: AWS::Serverless::Api
Properties:
StageName: dev
Auth:
DefaultAuthorizer:
NONE
DefinitionBody: {
"swagger": "2.0",
"info": {
"version": "2016-10-13T23:04:43Z",
"title": "MyS3"
},
"basePath": "/S3",
"schemes": [
"https"
],
"paths": {
"/{folder}/{item}": {
"get": {
"produces": [
"application/json"
],
"parameters": [
{
"name": "item",
"in": "path",
"required": true,
"type": "string"
},
{
"name": "folder",
"in": "path",
"required": true,
"type": "string"
}
],
"responses": {
"200": {
"description": "200 response",
"schema": {
"$ref": "#/definitions/Empty"
},
"headers": {
"content-type": {
"type": "string"
},
"Content-Type": {
"type": "string"
}
}
},
"400": {
"description": "400 response"
},
"500": {
"description": "500 response"
}
},
"security": [
{
"sigv4": []
}
],
"x-amazon-apigateway-integration": {
"credentials": !GetAtt s3AWSIntegrationExecutionRole.Arn,
"responses": {
"4\d{2}": {
"statusCode": "400"
},
"default": {
"statusCode": "200",
"responseParameters": {
"method.response.header.content-type": "integration.response.header.content-type",
"method.response.header.Content-Type": "integration.response.header.Content-Type"
}
},
"5\d{2}": {
"statusCode": "500"
}
},
"requestParameters": {
"integration.request.path.object": "method.request.path.item",
"integration.request.path.bucket": "method.request.path.folder"
},
"uri": "arn:aws:apigateway:eu-west-2:s3:path/{bucket}/{object}",
"passthroughBehavior": "when_no_match",
"httpMethod": "GET",
"type": "aws"
}
}
}
}
}