我将尝试创建一个AWS API网关,类型为PRIVATE。这需要一个资源策略,我已经有了,因为我可以通过AWS控制台创建网关。我想知道如何通过CF模板添加资源策略。以下是资源策略的Swagger定义:
https://docs.aws.amazon.com/zh_cn/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html
https://medium.com/@cathmgarcia/aws-sam中基于inline-swagger的条件资源策略管理-816ce946dbb
x-amazon-apigateway-policy:
Version: "2012-10-17"
Statement:
- Effect: "Deny"
Principal: "*"
Action: "execute-api:Invoke"
Resource: "arn:aws:execute-api:us-east-1:awsAccountId:xxxx/*/*/*"
Condition:
StringNotEquals:
aws:sourceVpc: "vpc-xxxxx"
- Effect: "Allow"
Principal: "*"
Action: "execute-api:Invoke"
Resource: "arn:aws:execute-api:us-east-1:xxxx:xxxx/*/*/*"
如何在 CF 模板中进行配置 -
AWSTemplateFormatVersion: 2010-09-09
Transform: 'AWS::Serverless-2016-10-31'
Description: G2G Api Template Stack
Resources:
g2gPrivate:
Type: 'AWS::ApiGateway::RestApi'
Properties:
Name: 'private-gw'
EndpointConfiguration:
Types:
- PRIVATE
参考 -https://docs.aws.amazon.com/zh_cn/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-restapi.html
https://medium.com/@cathmgarcia/aws-sam中基于inline-swagger的条件资源策略管理-816ce946dbb
arn:aws:execute-api:us-east-1:${AWS::AccountId}:*/*/*/*
这样做是安全的,因为策略明确与此API网关相关联。 - Mat