如何使用AWS为HttpApi配置自定义域？

Question

我正在使用AWS、API网关和AWS开发一个API。我已经实现了防火墙身份验证。我还使用嵌套堆栈。

我试图为我的API端点使用一个自定义域，这样我就可以调用诸如api.mydomain.com/products、api.mydomain.com/sales等等。我已经准备好域，以及AWS证书管理器的证书。我甚至能够在没有域配置的情况下部署我的aws-sam应用程序，然后通过AWS API Gateway web控制台手动分配自定义域和域映射。

但我需要在aws-sam本身做这部分。下面是我试过的。

根堆栈

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aws-restapi

  Sample SAM Template for aws-restapi
  
# More info about Globals: https://github.com/awslabs/serverless-application-model/blob/master/docs/globals.rst
Globals:
  Function:
    Timeout: 5
    VpcConfig:
        SecurityGroupIds:
          - sg-041f215425921e8e
        SubnetIds:
          - subnet-0251b2d


Parameters:
  FirebaseProjectId:
    Type: String
  
  DomainName:
    Type: String
    Default: api.example.com

Resources:
  AuthGatewayHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Auth:
        Authorizers:
          FirebaseAuthorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              audience:
                - !Ref FirebaseProjectId
              issuer: !Sub https://securetoken.google.com/${FirebaseProjectId}
        DefaultAuthorizer: FirebaseAuthorizer

  AppDomainName:
    Type: AWS::ApiGateway::DomainName
    Properties:
      CertificateArn: arn:aws:acm:us-east-1:xxxxxxx43:certificate/1axxxf-3234-xxx2f-a61c-924eeexxxx9
      DomainName: !Ref DomainName

  APIBasePathMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      BasePath: "api"
      DomainName: !Ref AppDomainName
      Stage: "default"
      RestApiId: !Ref AuthGatewayHttpApi
  
  AuthFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: aws-restapi/
      Handler: source/testfile.lambdaHandler
      Runtime: nodejs14.x
      Events:
        Gateway:
          Type: HttpApi
          Properties:
            ApiId: !Ref AuthGatewayHttpApi
            Path: /hello
            Method: get

  GetAllAccountingTypesFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/accounting-types/accountingtypes-getall.getallaccountingtypes
      Runtime: nodejs14.x
      Events:
        GetAllAccountingTypesAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            ApiId: !Ref AuthGatewayHttpApi
            Path: /accountingtypes/getall
            Method: get

  GetAccountingTypeByIDFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/accounting-types/accountingtypes-byid.getbyid
      Runtime: nodejs14.x
      Events:
        GetAllAccountingTypesAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /accountingtypes/getbyid
            Method: get

嵌套堆栈

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  aws-restapi

  Sample SAM Template for aws-restapi

Globals:
  Function:
    Timeout: 5
    VpcConfig:
        SecurityGroupIds:
          - sg-041f2459xxxx1e8e
        SubnetIds:
          - subnet-03xxxx2d

Parameters:
  FirebaseProjectId:
    Type: String

Resources:

  AuthGatewayHttpApi:
    Type: AWS::Serverless::HttpApi
    Properties:
      Auth:
        Authorizers:
          FirebaseAuthorizer:
            IdentitySource: $request.header.Authorization
            JwtConfiguration:
              audience:
                - !Ref FirebaseProjectId
              issuer: !Sub https://securetoken.google.com/${FirebaseProjectId}
        DefaultAuthorizer: FirebaseAuthorizer

  GetAllPromotionsFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/promotions/promotions-getall.getAllPromotions
      Runtime: nodejs14.x
      Events:
        GetAllPromotionsAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /promotions/getall
            Method: get
            ApiId: !Ref AuthGatewayHttpApi
  SavePromotionsFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
      CodeUri: aws-restapi/
      Handler: source/promotions/promotions-save.savePromotions
      Runtime: nodejs14.x
      Events:
        SavePromotionsAPIEvent:
          Type: HttpApi # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            Path: /promotions/save
            Method: get

然而，我不能让这件事起作用。我甚至尝试只将其应用于根堆栈，然后出现以下错误。

Mixing of REST APIs and HTTP APIs on the same domain name can only be accomplished through API Gateway's V2 DomainName interface. 
Currently, WebSocket APIs can only be attached to a domain name with other WebSocket APIs. 
This must also occur through API Gateway's V2 DomainName interface. 
(Service: AmazonApiGateway; Status Code: 400; Error Code: BadRequestException; Request ID: 2f44d53b-8175-47f5-8bc8-db5 19aa484e7; Proxy: null)   

如何成功地配置与API网关一起使用的自定义域？

Answer 1

添加域属性配置，下面是一个示例：

AuthGatewayHttpApi:
  Type: AWS::Serverless::HttpApi
  Properties:
    Auth:
      Authorizers:
        FirebaseAuthorizer:
          IdentitySource: $request.header.Authorization
          JwtConfiguration:
            audience:
              - !Ref FirebaseProjectId
            issuer: !Sub https://securetoken.google.com/${FirebaseProjectId}
      DefaultAuthorizer: FirebaseAuthorizer
    Domain:
      DomainName: www.example.com
      CertificateArn: arn-example
      EndpointConfiguration: REGIONAL
      Route53:
        HostedZoneId: Z1PA6795UKMFR9

更多信息在这里：https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-httpapi-httpapidomainconfiguration.html#sam-property-httpapi-httpapidomainconfiguration--examples