授予AWS Api网关使用BOTO3调用Lambda函数的权限

Question

# Create a rest api
self.rest_api = self.apigateway.create_rest_api(
    name='AWS_CMS_Operations'
)

# Get the rest api's root id
root_id = self.apigateway.get_resources(
    restApiId=self.rest_api['id']
)['items'][0]['id']

# Create an api resource
api_resource = self.apigateway.create_resource(
    restApiId=self.rest_api['id'],
    parentId=root_id,
    pathPart='AWS_CMS_Manager'
)

# Add a post method to the rest api resource
api_method = self.apigateway.put_method(
    restApiId=self.rest_api['id'],
    resourceId=api_resource['id'],
    httpMethod='POST',
    authorizationType='NONE'
)

# Add an integration method to the api resource
self.apigateway.put_integration(
    restApiId=self.rest_api['id'],
    resourceId=api_resource['id'],
    httpMethod='POST',
    type='AWS',
    integrationHttpMethod='POST',
    uri=self.create_api_invocation_uri()
)

# Set the put method response for the api resource
self.apigateway.put_method_response(
    restApiId=self.rest_api['id'],
    resourceId=api_resource['id'],
    httpMethod='POST',
    statusCode='200',
    responseModels={
        'application/json': 'Empty'
    }
)

# Set the put integration response for the api resource
self.apigateway.put_integration_response(
    restApiId=self.rest_api['id'],
    resourceId=api_resource['id'],
    httpMethod='POST',
    statusCode='200',
    responseTemplates={
        'application/json': ''
    }
)

# Create a deployment of the rest api
self.apigateway.create_deployment(
    restApiId=self.rest_api['id'],
    stageName='prod'
)

# Give the api deployment permission to trigger the lambda function
self.lmda.add_permission(
    FunctionName=self.lmda_function['FunctionName'],
    StatementId='apigateway-production-aws-cms',
    Action='lambda:InvokeFunction',
    Principal='apigateway.amazonaws.com',
    SourceArn=self.create_api_permission_uri(api_resource)
)

Answer 1

我能够在Boto3中使用以下代码使其工作：

source_arn = f'arn:aws:execute-api:{REGION}:{account_id}:{api_id}/*/*/{api_path}'
lambda_client.add_permission(FunctionName=lambda_function_arn, StatementId=f'invoke_{api_id}', 
        Action='lambda:InvokeFunction', Principal='apigateway.amazonaws.com',
        SourceArn=source_arn)

这里没有使用原问题中使用的约定，但我想指出三点，这可能对任何想解决这个问题的人有帮助：

1. 根据Boto3文档，FunctionName参数可以采用函数名、函数的ARN或部分ARN。
2. 您的帐户中的StatementId必须唯一。为了确保唯一性，我在API ID后面附加了一些内容，因为每个API只需要一个规则。
3. 源是API/分段位置的“execute-api”ARN。我在别处还没见过这个ARN。