Aws api gateway 和swagger工具的结合使用

aws api gateway 介绍

api的网关。主要目的是用来控制api的。
- 所有api都可以写如到api gateway中。
- 在api gateway中控制api的调用次数，吞吐量，是否允许调用
- 在 api gateway中控制这个API 触发的aws的服务

swagger 介绍

用来编写API文档，有专门的swagger语法。简单点说就是用文字信息和特定的格式来描述一个API

swagger集成 api gateway

介绍

swagger网站上有关于集成api gateway的功能。可以做到一键集成（注意，集成的时候最好选则overwrite，每次保存都会完整的更新api gateway）
所有api gateway的功能，包括authorized response lambda 都可以用swagger文档来完成。最后一键集成到api Gateway中

如何集成

google一下swagger，注册swagger hub的账号。
编写swagger的文档
找到 Integrations按钮（藏的有点深，我找了半天），选择集成 aws api gateway
配置好aws 的key和secret 保存并执行。这样以后每次编写swagger文档都会更新api gateway了

swagger的编写（yaml格式）

swagger 文档如何编写我这里就不说了，自行google，多尝试就OK了。在swagger官网中编写会有错误提示，还是比较方便的。
这篇文章主要介绍的是和api gateway相关的内容
swagger集成api gateway的文档例子

https://github.com/aws-samples/api-gateway-secure-pet-store/blob/master/src/main/resources/swagger.yaml


# this is an example of the Uber API
# as a demonstration of an API spec in YAML
swagger: '2.0'
info:
  title: API Gateway Secure Pet Store
  description: Pet store sample that uses Cognito Developer Authenticated Identities to generate credentials through a Java Lambda Function
  version: "1.0.0"
# the domain of the service
host: execute-api.us-east-1.amazonaws.com
# array of all schemes that your API supports
schemes:
  - https
# will be prefixed to all paths
basePath: /
produces:
  - application/json
paths:
  /users:
    post:
      summary: Registers a new user
      description: |
        Creates a new user in the DynamoDB backend database and returns a set
        of temporary credentials to sign future requests.
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - name: NewUser
          in: body
          description: New user details.
          schema:
            $ref: '#/definitions/User'
      tags:
        - Auth
      x-amazon-apigateway-integration:
        type: aws
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:XXXXXXXXXXXX:function:YOUR_FUNCTION_NAME/invocations
        credentials: arn:aws:iam::XXXXXXXXXXXX:role/YOUR_LAMBDA_INVOCATION_ROLE
        httpMethod: POST
        requestTemplates:
          application/json: |
            {
              "action" : "com.amazonaws.apigatewaydemo.action.RegisterDemoAction",
              "body" : $input.json('$')
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "BAD.*":
            statusCode: "400"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "INT.*":
            statusCode: "500"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
      responses:
        200:
          description: The username of the new user and set of temporary credentials
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/RegisterUserResponse'
        400:
          description: Bad request
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
        500:
          description: Internal error
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
    options:
      summary: CORS support
      description: |
        Enable CORS by returning correct headers
      consumes:
        - application/json
      produces:
        - application/json
      tags:
        - CORS
      x-amazon-apigateway-integration:
        type: mock
        requestTemplates:
          application/json: |
            {
              "statusCode" : 200
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Headers : "'Content-Type,X-Amz-Date,Authorization,X-Api-Key'"
              method.response.header.Access-Control-Allow-Methods : "'*'"
              method.response.header.Access-Control-Allow-Origin : "'*'"
            responseTemplates:
              application/json: |
                {}
      responses:
        200:
          description: Default response for CORS method
          headers:
            Access-Control-Allow-Headers:
              type: "string"
            Access-Control-Allow-Methods:
              type: "string"
            Access-Control-Allow-Origin:
              type: "string"
  /login:
    post:
      summary: Login user
      description: |
        Verifies the given credentials against the user database and returns a set
        of new temporary credentials
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - name: LoginUser
          in: body
          description: New user details.
          schema:
            $ref: '#/definitions/User'
      tags:
        - Auth
      x-amazon-apigateway-integration:
        type: aws
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:XXXXXXXXXXXX:function:YOUR_FUNCTION_NAME/invocations
        credentials: arn:aws:iam::XXXXXXXXXXXX:role/YOUR_LAMBDA_INVOCATION_ROLE
        httpMethod: POST
        requestTemplates:
          application/json: |
            {
              "action" : "com.amazonaws.apigatewaydemo.action.LoginDemoAction",
              "body" : $input.json('$')
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "BAD.*":
            statusCode: "400"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "INT.*":
            statusCode: "500"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
      responses:
        200:
          description: A new set of temporary credentials
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/LoginUserResponse'
        400:
          description: Bad request
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
        500:
          description: Internal error
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
    options:
      summary: CORS support
      description: |
        Enable CORS by returning correct headers
      consumes:
        - application/json
      produces:
        - application/json
      tags:
        - CORS
      x-amazon-apigateway-integration:
        type: mock
        requestTemplates:
          application/json: |
            {
              "statusCode" : 200
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Headers : "'Content-Type,X-Amz-Date,Authorization,X-Api-Key'"
              method.response.header.Access-Control-Allow-Methods : "'*'"
              method.response.header.Access-Control-Allow-Origin : "'*'"
            responseTemplates:
              application/json: |
                {}
      responses:
        200:
          description: Default response for CORS method
          headers:
            Access-Control-Allow-Headers:
              type: "string"
            Access-Control-Allow-Methods:
              type: "string"
            Access-Control-Allow-Origin:
              type: "string"
  /pets:
    post:
      summary: Creates a new pet
      description: |
        Creates a new pet object in the datastore
      x-amazon-apigateway-auth:
        type: aws_iam
      consumes:
        - application/json
      produces:
        - application/json
      parameters:
        - name: NewPet
          in: body
          description: New pet details.
          schema:
            $ref: '#/definitions/NewPet'
      tags:
        - Pet Store
      x-amazon-apigateway-integration:
        type: aws
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:XXXXXXXXXXXX:function:YOUR_FUNCTION_NAME/invocations
        credentials: arn:aws:iam::*:user/*
        httpMethod: POST
        requestTemplates:
          application/json: |
            {
              "action" : "com.amazonaws.apigatewaydemo.action.CreatePetDemoAction",
              "body" : $input.json('$')
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "BAD.*":
            statusCode: "400"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "INT.*":
            statusCode: "500"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
      responses:
        200:
          description: The unique identifier of the new pet
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/NewPetResponse'
        400:
          description: Bad request
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
        500:
          description: Internal error
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
    get:
      summary: List pets
      description: Retrieve a list of pets in the store
      x-amazon-apigateway-auth:
        type: aws_iam
      consumes:
        - application/json
      produces:
        - application/json
      tags:
        - Pet Store
      x-amazon-apigateway-integration:
        type: aws
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:XXXXXXXXXXXX:function:YOUR_FUNCTION_NAME/invocations
        credentials: arn:aws:iam::*:user/*
        httpMethod: POST
        requestTemplates:
          application/json: |
            {
              "action" : "com.amazonaws.apigatewaydemo.action.ListPetsDemoAction",
              "body" : $input.json('$')
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "BAD.*":
            statusCode: "400"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "INT.*":
            statusCode: "500"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
      responses:
        200:
          description: A list of pets
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Pets'
        400:
          description: Bad request
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
        500:
          description: Internal error
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
    options:
      summary: CORS support
      description: |
        Enable CORS by returning correct headers
      consumes:
        - application/json
      produces:
        - application/json
      tags:
        - CORS
      x-amazon-apigateway-integration:
        type: mock
        requestTemplates:
          application/json: |
            {
              "statusCode" : 200
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Headers : "'Content-Type,X-Amz-Date,Authorization,X-Api-Key'"
              method.response.header.Access-Control-Allow-Methods : "'*'"
              method.response.header.Access-Control-Allow-Origin : "'*'"
            responseTemplates:
              application/json: |
                {}
      responses:
        200:
          description: Default response for CORS method
          headers:
            Access-Control-Allow-Headers:
              type: "string"
            Access-Control-Allow-Methods:
              type: "string"
            Access-Control-Allow-Origin:
              type: "string"
  /pets/{petId}:
    get:
      summary: Get pet by id
      description: Returns a pet definition based on the given id
      x-amazon-apigateway-auth:
        type: aws_iam
      consumes:
        - application/json
      produces:
        - application/json
      tags:
        - Pet Store
      parameters:
        - name: petId
          in: path
          description: The unique identifier for a pet
          type: string
      x-amazon-apigateway-integration:
        type: aws
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:XXXXXXXXXXXX:function:YOUR_FUNCTION_NAME/invocations
        credentials: arn:aws:iam::*:user/*
        httpMethod: POST
        requestTemplates:
          application/json: |
            {
              "action" : "com.amazonaws.apigatewaydemo.action.GetPetDemoAction",
              "body" : {
                "petId" : "$input.params('petId')"
              }
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "BAD.*":
            statusCode: "400"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
          "INT.*":
            statusCode: "500"
            responseParameters:
              method.response.header.Access-Control-Allow-Origin : "'*'"
      responses:
        200:
          description: A pet
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Pet'
        400:
          description: Bad request
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
        500:
          description: Internal error
          headers:
            Access-Control-Allow-Origin:
              type: "string"
          schema:
            $ref: '#/definitions/Error'
    options:
      summary: CORS support
      description: |
        Enable CORS by returning correct headers
      consumes:
        - application/json
      produces:
        - application/json
      tags:
        - CORS
      x-amazon-apigateway-integration:
        type: mock
        requestTemplates:
          application/json: |
            {
              "statusCode" : 200
            }
        responses:
          "default":
            statusCode: "200"
            responseParameters:
              method.response.header.Access-Control-Allow-Headers : "'Content-Type,X-Amz-Date,Authorization,X-Api-Key'"
              method.response.header.Access-Control-Allow-Methods : "'*'"
              method.response.header.Access-Control-Allow-Origin : "'*'"
            responseTemplates:
              application/json: |
                {}
      responses:
        200:
          description: Default response for CORS method
          headers:
            Access-Control-Allow-Headers:
              type: "string"
            Access-Control-Allow-Methods:
              type: "string"
            Access-Control-Allow-Origin:
              type: "string"
definitions:
  User:
    properties:
      username:
        type: string
        description: A unique username for the user
      password:
        type: string
        description: A password for the new user
  RegisterUserResponse:
    properties:
      username:
        type: string
        description: The username of the new user
      identityId:
        type: string
        description: The unique identifier for the new user
      token:
        type: string
        description: An OpenID token for the new user
      credentials:
        type: object
        properties:
          accessKey:
            type: string
            description: Temporary access key to sign requests
          secretKey:
            type: string
            description: Temporary secret access key to sign requests
          sessionToken:
            type: string
            description: Tempoarary session token
          expiration:
            type: integer
            description: |
              Expiration date of the temporary credentials in millis since 1/1/1970
  LoginUserResponse:
    properties:
      identityId:
        type: string
        description: The unique identifier for the new user
      token:
        type: string
        description: An OpenID token for the new user
      credentials:
        type: object
        properties:
          accessKey:
            type: string
            description: Temporary access key to sign requests
          secretKey:
            type: string
            description: Temporary secret access key to sign requests
          sessionToken:
            type: string
            description: Tempoarary session token
          expiration:
            type: integer
            description: |
              Expiration date of the temporary credentials in millis since 1/1/1970
  NewPet:
    properties:
      petType:
        type: string
        description: Free text pet type
      petName:
        type: string
        description: Free text pet name
      petAge:
        type: integer
        description: Age of the new pet
  NewPetResponse:
    properties:
      petId:
        type: string
        description: The generated unique identifier for the new pet
  Pet:
    properties:
      petId:
        type: string
        description: The generated unique identifier for the new pet
      petType:
        type: string
        description: Free text pet type
      petName:
        type: string
        description: Free text pet name
      petAge:
        type: integer
        description: Age of the new pet
  Pets:
    type: array
    items:
      $ref: Pet
  Error:
    properties:
      code:
        type: integer
        format: int32
      message:
        type: string
      fields:
        type: string

内容很长，不要害怕，分解开来就简单了。把复杂的事情分解一下就变简单了。

设置触发的lambda 函数

      x-amazon-apigateway-integration:
        type: "aws_proxy"
        httpMethod: "POST"
        uri:  "arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:<accountId>:function:<function-name>/invocations"
        credentials: "arn:aws:iam::<accountId>:role/<role-name>"

x-amazon-apigateway-integration 代表集成apigateway
type 代表使用了lambda代理
httpMethod 必须是POST
uri就是lambda的路径
credentials：这个是证书的意思，比较复杂。不写也可以集成，但是你会发现无法让API gateway 触发lamnda，会报permission之类的错误

设置 credentials

首先要创建一个角色
要给这个角色赋予AWSLambdaFullAccess的policy权限
要让这个角色相信api gateway(role>>Trust relationships>>edit>>save)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "lambda.amazonaws.com",
          "apigateway.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

要让设置在swagger中的用户拥有passRole的权限
- 创建一个policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "PolicyStatementToAllowUserToPassOneSpecificRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::<accountId>:role/swagger-role"
        }
    ]
}

把这个policy添加给用户。这样设置给swagger的aws用户就拥有PassRole的权限了，这样写到credentials的role-那么就能发挥作用了。

设置api gateway的 authorise 验证,

放到和paths在同一级别下

securityDefinitions:
  cognito_auth:
    type: "apiKey"
    name: "accessToken"
    in: "header"
    x-amazon-apigateway-authtype: "cognito_user_pools"
    x-amazon-apigateway-authorizer:
      type: "cognito_user_pools"
      providerARNs: ["arn:aws:cognito-idp:us-west-2:<accountId>:userpool/<userpoolId>"]
  request_lambda_auth:
    type: "apiKey"
    name: "Unused"
    in: "header"
    x-amazon-apigateway-authtype: "custom"
    x-amazon-apigateway-authorizer:
      type: "request"
      identitySource : "method.request.header.access_key, method.request.header.access_type"
      authorizerUri: "arn:aws:apigateway:us-west-2:lambda:path/2015-03-31/functions/arn:aws:lambda:us-west-2:<accountId>:function:<lambda name>/invocations"
      authorizerResultTtlInSeconds : 300

这样写好后，你就可以将cognito_auth 或者request_lambda_auth 放置到每个API的security下了

设置 api gateway的错误返回模版

x-amazon-apigateway-gateway-responses: 
  BAD_REQUEST_PARAMETERS:
    statusCode: 400
    responseTemplates:
      application/json: "{\"error\":{\"code\":400,\"name\":\"ParameterIncorrectException\",\"message\": $context.error.messageString} }"

最后编辑于：2019.04.09 17:56:18

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 219,427评论 6赞 508
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 93,551评论 3赞 395
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 165,747评论 0赞 356
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 58,939评论 1赞 295
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 67,955评论 6赞 392
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 51,737评论 1赞 305
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 40,448评论 3赞 420
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 39,352评论 0赞 276
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 45,834评论 1赞 317
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 37,992评论 3赞 338
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 40,133评论 1赞 351
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 35,815评论 5赞 346
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 41,477评论 3赞 331
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 32,022评论 0赞 22
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 33,147评论 1赞 272
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 48,398评论 3赞 373
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 45,077评论 2赞 355

Aws api gateway 和swagger工具的结合使用

aws api gateway 介绍

swagger 介绍

swagger集成 api gateway

介绍

如何集成

swagger的编写（yaml格式）

内容很长，不要害怕，分解开来就简单了。把复杂的事情分解一下就变简单了。

设置触发的lambda 函数

设置 credentials

设置api gateway的 authorise 验证,

设置 api gateway的错误返回模版

推荐阅读更多精彩内容