rest api 调用 lambda 函数，terraform 部署

Question

我在 terraform 中设置 rest api 以调用 lambda 函数时遇到问题。我遗漏了一些东西，因为当我从 terraform 部署 lambda 函数并从具有相同配置的 aws 控制台手动创建 rest api 时（已经检查控制台配置 5 次，它与使用 terraform 部署的相同）。因此，当我使用 terraform 进行部署时，我会得到 {"message": "Internal server error"} 响应。在我的 lambda、rest api 和 ham 的 terraform 代码下方。知道我在 terraform conf 中遗漏了什么。很确定我在其余的 api 部分遗漏了一些东西......

resource "aws_api_gateway_rest_api" "search_api" {
  name = "search_api"
  endpoint_configuration {
    types = ["REGIONAL"]
  }
}

resource "aws_api_gateway_resource" "search_api" {
  rest_api_id = aws_api_gateway_rest_api.search_api.id
  parent_id   = aws_api_gateway_rest_api.search_api.root_resource_id
  path_part   = "search"
}

resource "aws_api_gateway_method" "search_api" {
  rest_api_id   = aws_api_gateway_rest_api.search_api.id
  resource_id   = aws_api_gateway_resource.search_api.id
  http_method   = "GET"
  authorization = "NONE"
}

resource "aws_api_gateway_method_response" "response_200" {
  rest_api_id = aws_api_gateway_rest_api.search_api.id
  resource_id = aws_api_gateway_resource.search_api.id
  http_method = aws_api_gateway_method.search_api.http_method
  status_code = "200"

  response_models = {
    "application/json" = null
  }
}

resource "aws_api_gateway_integration" "search_api" {
  rest_api_id             = aws_api_gateway_rest_api.search_api.id
  resource_id             = aws_api_gateway_resource.search_api.id
  http_method             = aws_api_gateway_method.search_api.http_method
  integration_http_method = "GET"
  type                    = "AWS"
  uri                     = aws_lambda_function.lambda_search_py.invoke_arn
  credentials = aws_iam_role.search_py_lambda_execution.arn

  request_templates = {
    "application/json" = jsonencode(
      {
        name = "$input.params('name')"
    })
  }

  depends_on = [aws_lambda_permission.lambda_search_py]
}

resource "aws_api_gateway_integration_response" "search_api" {
  http_method = aws_api_gateway_method.search_api.http_method
  resource_id = aws_api_gateway_resource.search_api.id
  rest_api_id = aws_api_gateway_rest_api.search_api.id
  status_code = aws_api_gateway_method_response.response_200.status_code

  depends_on = [
    aws_api_gateway_integration.search_api
  ]
}

resource "aws_api_gateway_deployment" "search_api" {
  rest_api_id = aws_api_gateway_rest_api.search_api.id
  stage_name  = "test"

  depends_on = [aws_api_gateway_integration.search_api]
}

output "search_api_url" {
  value = aws_api_gateway_deployment.search_api.invoke_url
}

resource "aws_lambda_function" "lambda_search_py" {
  function_name    = "SearchField"
  s3_bucket        = aws_s3_bucket.lambda.id
  s3_key           = aws_s3_object.s3_search_py.key
  runtime          = "python3.9"
  handler          = "lambda_function.lambda_handler"
  source_code_hash = data.archive_file.data_lambda_search_py.output_base64sha256
  role             = aws_iam_role.lambda_role.arn

  vpc_config {
    subnet_ids         = [data.terraform_remote_state.infra.outputs.subnet_main_prv1a_id, data.terraform_remote_state.infra.outputs.subnet_main_prv2b_id]
    security_group_ids = [data.terraform_remote_state.infra.outputs.secgrp_ec2_id]
  }
}

resource "aws_lambda_permission" "lambda_search_py" {
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.lambda_search_py.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_api_gateway_rest_api.search_api.execution_arn}/*/GET/search"
}

resource "aws_iam_role" "lambda_role" {
  name = "lambda_role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Sid    = ""
      Principal = {
        Service = "lambda.amazonaws.com"
      }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "AWSLambda_FullAccess" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = "arn:aws:iam::aws:policy/AWSLambda_FullAccess"
}

resource "aws_iam_role_policy_attachment" "AWSLambdaVPCAccessExecutionRole" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
}


resource "aws_iam_role" "search_py_lambda_execution" {
  name = "lambda_execution"
  
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "apigateway.amazonaws.com"
        }
      }
    ]
  })
}
  
resource "aws_iam_policy" "search_py_lambda_execution" {
  name = "search_py_lambda_execution"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "lambda:InvokeFunction"
        Effect = "Allow"
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "search_py_lambda_execution1" {
  role = aws_iam_role.search_py_lambda_execution.name
  policy_arn = aws_iam_policy.search_py_lambda_execution.arn
}

resource "aws_iam_role_policy_attachment" "AmazonAPIGatewayInvokeFullAccess" {
  role = aws_iam_role.search_py_lambda_execution.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess"
}

我收到内部服务器错误，当我调用 rest api 时，我应该从 lambda 函数得到响应。如果我只从 Amazon 控制台创建 rest api 那么它就可以工作

Answer 1

使用 integration_http_method = "POST" 并且有效，感谢 Marko E 的建议