通过Cloudformation声明的API网关Cognito授权程序需要从管理控制台部署才能正常工作

Question

我不理解我的API网关和Cognito用户池授权器的以下行为。使用AWS SAM模板，我部署了以下Cognito用户池：

  CognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref CognitoUserPool
      ClientName: !Sub CognitoUserPoolClient-${StageName}
      GenerateSecret: false
      SupportedIdentityProviders:
        - COGNITO
      ExplicitAuthFlows:
        - ALLOW_USER_PASSWORD_AUTH
        - ALLOW_CUSTOM_AUTH
        - ALLOW_REFRESH_TOKEN_AUTH
        - ALLOW_USER_SRP_AUTH
  OptalXCognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      AutoVerifiedAttributes:
        - email
      EmailVerificationSubject: Verify your email.
      EmailVerificationMessage: Please click the link below to verify your email address. {####}
      EmailConfiguration:
        EmailSendingAccount: DEVELOPER
        From: Widgets Co <[e-mail]>
        ReplyToEmailAddress: [e-mail]
        SourceArn: !FindInMap [ StageMap, !Ref StageName, EmailSESArn ]
      UserPoolName: !Sub CognitoUserPool-${StageName}
      VerificationMessageTemplate:
        DefaultEmailOption: CONFIRM_WITH_LINK
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true
        UnusedAccountValidityDays: 90
        InviteMessageTemplate:
          EmailMessage: ...
          EmailSubject: Welcome to Widgets Co!
          SMSMessage: Your username is {username} and temporary password is {####}.
      Policies:
        PasswordPolicy:
          MinimumLength: 8
      UsernameAttributes:
        - email
      Schema:
        - AttributeDataType: String
          Name: user_id
          Mutable: false
          DeveloperOnlyAttribute: false
        - Name: email
          Mutable: false
          Required: true

然后，我定义了一个API网关，它使用Cognito用户池作为其授权者：

  WidgetsAPI:
    Type: 'AWS::Serverless::Api'
    Name: WidgetsAPI
    Properties:
      GatewayResponses:
        EXPIRED_TOKEN:
          ResponseParameters:
            Headers:
              Fail-Reason: "'Expired token'"
              Access-Control-Allow-Origin: "'*'"
        DEFAULT_4xx:
          ResponseParameters:
            Headers:
              Access-Control-Expose-Headers: "'WWW-Authenticate'"
              Access-Control-Allow-Origin: "'*'"
        DEFAULT_5XX:
          ResponseParameters:
            Headers:
              Fail-Reason: "'Internal server error. Check logs.'"
              Access-Control-Allow-Origin: "'*'"
      Auth:
        DefaultAuthorizer: CognitoAuthorizer
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !FindInMap [ StageMap, !Ref StageName, UserPoolArn ]
        AddDefaultAuthorizerToCorsPreflight: false

这里，我的userpoolarn在一个映射中，该映射根据我们所处的环境(stage或prod)而有所不同。我定义了一堆endpoint，但为了演示起见，这里有一个叫做/users的endpoint。

注意-关于这个主题有几篇文章（这里、这里和这里），但没有一篇文章描述我的问题，这就是为什么我的API网关在第一次应用Cloudformation堆栈时返回401 unauthorized错误，并且只有在我从控制台手动部署整个API网关阶段之后才能正常工作。

Answer 1

向模板中添加AWS::Apigateway::Deployment资源。

ApiGatewayDeployment:
  DependsOn:
    - Function1Name
    - Thing2Name
  Type: AWS::ApiGateway::Deployment
  Properties:
    RestApiId: !Ref WidgetsAPI
    StageName: !Sub ApiGateway-${ApiGatewayStageName}

现在，SAM deploy将使api部署到“apigateway-loremipsum”