AWS API网关：由于配置错误执行失败：响应中的JSON无效

Question

我有一个API网关设置，它带有一个调用Lambda函数的自定义授权程序。出于测试目的，我从这里复制了以下示例:http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-create-api-as-simple-proxy-for-lambda.html#api-gateway-proxy-integration-lambda-function-nodejs

我得到了与文档中相同的答案，但当我测试授权器时，我得到了这个StackTrace：

    Endpoint request body after transformations: {"type":"TOKEN","authorizationToken":"test","methodArn":"arn:aws:execute-api:ap-southeast-2:893445519708:uyue0zqh15/null/GET/"}
    Authorizer result body before parsing: {"statusCode":200,"headers":{"x-custom-header":"my custom header value"},"body":"{\"message\":\"Hello World!\",\"input\":{\"type\":\"TOKEN\",\"authorizationToken\":\"test\",\"methodArn\":\"arn:aws:execute-api:ap-southeast-2:893445519708:uyue0zqh15/null/GET/\"}}"}
    Execution failed due to configuration error: Invalid JSON in response: {"statusCode":200,"headers":{"x-custom-header":"my custom header value"},"body":"{\"message\":\"Hello World!\",\"input\":{\"type\":\"TOKEN\",\"authorizationToken\":\"test\",\"methodArn\":\"arn:aws:execute-api:ap-southeast-2:893445519708:uyue0zqh15/null/GET/\"}}"}
    AuthorizerConfigurationException

为什么授权者不喜欢JSON响应？

Answer 1

授权程序响应格式与集成代理响应格式不同。我看得出来这很混乱！

自定义授权程序的输出应符合以下格式：

{
  "principalId": "yyyyyyyy", // The principal user identification associated with the token sent by the client.
  "policyDocument": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "execute-api:Invoke",
        "Effect": "Allow|Deny",
        "Resource": "arn:aws:execute-api:<regionId>:<accountId>:<appId>/<stage>/<httpVerb>/[<resource>/<httpVerb>/[...]]"
      }
    ]
  },
  "context": {
    "key": "value",
    "numKey": 1,
    "boolKey": true
  }
}

PrincipalId和PolicyDocument是必需的，Context是可选的。

policydocument不是用户定义的，它与在API网关操作和参考资料http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policy-to-invoke-api.html上操作的常规IAM策略的语法相同

Lambda web控制台中也有很好的蓝图供python和node中的授权者使用，这里还有一个Java蓝图：https://github.com/awslabs/aws-apigateway-lambda-authorizer-blueprints