AWS API网关从专用子网中的EC2访问时出现403错误

Question

我有EC2实例在私有子网中运行，想要访问API网关。

我做的步骤：-

1. 在API网关中创建和部署阶段
2. 从测试URL和邮递员测试-工作良好
3. 创建了具有execute-api接口的VPCendpoint
4. 更新了API-Gateway资源策略，如下所示并已保存

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:eu-west-1:{{MY_ACCOUNT}}:{{MYAPI}}/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpc": "vpce-{{ID}}"
                }
            }
        }
    ]
}

[ec2-user@ip-xx-xx-xx-xx ~]$ wget https://{{MYAPI}}.execute-api.eu-west-1.amazonaws.com/DEV/CustomerInfo/?customerId={{CUST_ID}}
--2020-06-29 14:43:29--  https://{{MYAPI}}.execute-api.eu-west-1.amazonaws.com/DEV/CustomerInfo/?customerId={{CUST_ID}}
Resolving {{MYAPI}}.execute-api.eu-west-1.amazonaws.com ({{MYAPI}}.execute-api.eu-west-1.amazonaws.com)... xx.xx.xx.xx, xx.xx.xx.xxx
Connecting to {{MYAPI}}.execute-api.eu-west-1.amazonaws.com ({{MYAPI}}.execute-api.eu-west-1.amazonaws.com)|xx.xx.xx.xx|:443... connected.
HTTP request sent, awaiting response... 403 Forbidden
2020-06-29 14:43:29 ERROR 403: Forbidden.

Answer 1

您的状况：

"Condition": {
                "StringNotEquals": {
                    "aws:sourceVpc": "vpce-{{ID}}"
                }
            }

似乎不对。StringNoteQuals表示只要aws:sourceVPC与“vpce-{{ID}}不同，您就允许execute-api:invoke。

我相信应该是stringequals。