- 最新
- 最多得票
- 最多評論
Lambda functions, regardless if attached to your VPC or not, are actually running on the Lambda service VPC. The ONLY way to invoke them, is using the Lambda service Public Invoke API. This means that if you need to integrate API Gateway with a Lambda function, regardless if in the VPC or not, you need to use the Lambda integration option.
To restrict access to an HTTP API, you need to use an authorization method that the partenr doesn't have. In your example, I am guessing that the clients calling the API are actually server components, you can use an IAM authorizer. The partner should not have a role that allows them to invoke the API.
Is there a way that HTTP API can access privately my Lambda function running inside my VPC without using VPC link (since VPC link cannot integrate with lambda)?
Please note that you can configure an Application Load Balancer as a function trigger, grant Elastic Load Balancing permission to run the function, create a target group that routes requests to the function, and add a rule to the load balancer that sends requests to the target group [1], and then create a private integration that connects to a load balancer by using a VPC link.
To create a target group and register the Lambda function using the new console, follow steps below [2]:
- Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/
- On the navigation pane, under LOAD BALANCING, choose Target Groups.
- Choose Create target group.
- For Choose a target type, select Lambda function.
- For Target group name, type a name for the target group.
- (Optional) To enable health checks, choose Enable in the Health checks section.
- (Optional) Add one or more tags
- Choose Next.
- Specify a single Lambda function or omit this step and specify a Lambda function later.
- Choose Create target group.
Alternatively, you create a target group and register the Lambda function using the AWS CLI:
Use the create-target-group and register-targets commands.
Then you can use the following command to create a private integration that connects to a load balancer by using a VPC link:
aws apigatewayv2 create-integration --api-id api-id --integration-type HTTP_PROXY \
--integration-method GET --connection-type VPC_LINK \
--connection-id VPC-link-ID \
--integration-uri <LOAD_BALANCER_ARN_URI>
--payload-format-version 1.0
To grant Elastic Load Balancing permission to run the function you can use the add-permission command below to add a permission statement to your function's resource-based policy.
aws lambda add-permission --function-name alb-function \
--statement-id load-balancer --action "lambda:InvokeFunction" \
--principal elasticloadbalancing.amazonaws.com \
As HTTP API doesn't support private endpoints like the REST API, and also doesn't support resource policy, is there any other way to restrict access to it from partner VPC?
Since HTTP API does not not have support for private endpoints and resource policies, you can use mTLS(Mutual TLS authentication) to protect your HTTP API. mTLS requires two-way authentication between the client and the server.
References:
Thank you for your answer,
I use ELB that routes requests to the function even though I have only one lambda function behind?
相關內容
AWS 官方已更新 1 年前- AWS 官方已更新 1 年前
- AWS 官方已更新 2 年前
Thank you for your answer! Sorry i did not fully understand this "You need to use an authorization method that the partner doesn't have", "The partner should not have a role that allows them to invoke the API"
I'm exposing a rest service via HTTP API GW backed by lambda to generate a pre-signed URL , this rest service is consumed by a third party( salesforce)
(I'm thinking to use HTTP API gw not REST API GW) and I don't have the right to add any IAM user on the AWS account
I understand. In that case, you will need to use some other authorizer. It can be a JWT authorizer, or maybe a Lambda authorizer, that will check some secret value. Of course, if there is private network connectivity between Salesforce and your VPC, you can use a Private REST API instead.