Serverless+Webpack:在 ZIP 中包含 .pem 文件

Question

我尝试使用无服务器将我的lambda函数部署到AWS。一切正常，但无法执行该函数，因为找不到两个文件(这就是fs.readFileSync所说的(。我在serverless.yml中使用以下行包含它们：

provider:
name: aws
runtime: nodejs10.x
stage: dev
region: eu-central-1
package:
exclude:
- .env
include:
- src/config/push-cert.pem
- src/config/push-key.pem

当我查看上传到 S3 的.zip文件时，不包括两个 .pem 文件。我已经尝试使用__dirname来获取 lambda 函数的完整文件路径。 我的webpack.config.js如下所示：

const path = require("path");
const nodeExternals = require("webpack-node-externals");
const slsw = require("serverless-webpack");
module.exports = {
entry: slsw.lib.entries,
target: "node",
node: {
__dirname: true
},
mode: slsw.lib.webpack.isLocal?"development":"production",
externals: [nodeExternals()],
output: {
libraryTarget: "commonjs",
// pay attention to this
path: path.join(__dirname, ".webpack"),
filename: "[name].js"
},
module: {
rules: [
{
test: /.js$/,
use: [
{
loader: "babel-loader",
options: {
// ... and this
presets: [["@babel/env", {targets: {node: "8.10"}}]],
plugins: [
"@babel/plugin-proposal-object-rest-spread"
]
}
}
]
},
{
test: /.(graphql|gql)$/,
exclude: /node_modules/,
loader: "graphql-tag/loader"
}
]
}
};

你们有人可以帮忙吗？

干杯！

Answer 1

由于serverless-webpack为您而不是无服务器框架进行打包，因此您需要使用 Webpack 插件：

const path = require("path");
const nodeExternals = require("webpack-node-externals");
const slsw = require("serverless-webpack");
const CopyPlugin = require('copy-webpack-plugin');
module.exports = {
entry: slsw.lib.entries,
target: "node",
node: {
__dirname: true
},
mode: slsw.lib.webpack.isLocal?"development":"production",
externals: [nodeExternals()],
plugins: [
new CopyPlugin([
{ from: 'src/config/push-cert.pem', to: 'push-cert.pem' },
{ from: 'src/config/push-key.pem', to: 'push-key.pem' },
]),
],
output: {
libraryTarget: "commonjs",
// pay attention to this
path: path.join(__dirname, ".webpack"),
filename: "[name].js"
},
module: {
rules: [
{
test: /.js$/,
use: [
{
loader: "babel-loader",
options: {
// ... and this
presets: [["@babel/env", {targets: {node: "8.10"}}]],
plugins: [
"@babel/plugin-proposal-object-rest-spread"
]
}
}
]
},
{
test: /.(graphql|gql)$/,
exclude: /node_modules/,
loader: "graphql-tag/loader"
}
]
}
};

如@hephalump所述，最好使用 AWS 密钥管理器(或参数存储/环境变量(。

Answer 2

尽管您绝对可以将证书文件作为部署包的一部分包含在内，并且如果没有更多信息，我不确定为什么不包括它们，但更安全的方法是将您的证书/密钥存储在 AWS 密钥管理器中，然后在您的 Lambda 中访问该密钥。

您可以在此处了解有关 AWS Secrets Manager 的更多信息，此处提供了存储和检索密钥的教程。