尝试连接到AWS网关专用API时出现UnknownHostException

Question

我这样做：

• https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html
• https://aws.amazon.com/blogs/compute/induction-amazon-api-gateway-private-endpoints/tutorials

以创建REST APIendpoint之间的私有链接。

基本上，我所做的步骤：

>

将（以前工作的）边缘API转换为私有API（通过AWS API网关控制台）

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-west-2:{aws-account-id}:{rest-api-id}/*/*/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": "vpce-{endpoint}"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-west-2:{aws-account-id}:{rest-api-id}/*/*/*"
        }
    ]
}

然后，我使用AWS SDK创建的Java客户机：https://AWS.amazon.com/sdk-for-java/来调用API，结果遇到了以下错误：

com.amazonaws.SdkClientException: Unable to execute HTTP request: {rest-api-id}.execute-api.us-west-2.amazonaws.com

...

Caused by: java.net.UnknownHostException: {rest-api-id}.execute-api.us-west-2.amazonaws.com

当我使用邮递员时也发生了同样的问题。

正如https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html以及API网关控制台中所指出的，如果我启用了私有DNS，我应该能够使用URL调用API。

Answer 1

资源策略应该具有基于VPCendpoint的条件，而不是显示的基于VPC的条件。尝试将“aws：sourceVpce”：“vpce-{endpoint}”替换为“aws：sourceVpce”：“vpce-{endpoint}”，然后重新部署。