AWS Lambda Function URL 开启 IAM 认证

调用权限

IAM 配置

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeFunctionUrl",
        "lambda:InvokeFunction"
      ],
      "Resource": "arn:aws:lambda:ap-southeast-1:123456789012:function:your-function-name",
      "Condition": {
        "StringEquals": {
          "lambda:FunctionUrlAuthType": "AWS_IAM"
        },
        "Bool": {
          "lambda:InvokedViaFunctionUrl": "true"
        }
      }
    }
  ]
}

跨账号调用

如果是跨账号调用，还要在 Lambda 函数的 resource-based policy 里允许调用方账号或 Role；

AWS 文档说明，同账号可以通过 identity-based policy 或 function resource-based policy 授权，跨账号通常需要两边都配置权限。

Node.js 代码

安装依赖

pnpm install @smithy/signature-v4 @aws-crypto/sha256-js @aws-sdk/credential-provider-node

以 POST 请求为例

import { SignatureV4 } from "@smithy/signature-v4";
import { Sha256 } from "@aws-crypto/sha256-js";
import { defaultProvider } from "@aws-sdk/credential-provider-node";

const region = process.env.AWS_REGION || "us-east-1";

const signer = new SignatureV4({
    credentials: defaultProvider(),
    region: region,
    service: "lambda",
    sha256: Sha256,
});

async function callFunctionUrl(functionUrl: string, payload: any) {
    const url = new URL(functionUrl);
    const body = JSON.stringify(payload);

    const signed = await signer.sign({
        method: "POST",
        protocol: url.protocol,
        hostname: url.hostname,
        path: url.pathname + url.search,
        headers: {
            host: url.hostname,
            "content-type": "application/json",
        },
        body,
    });

    const resp = await fetch(functionUrl, {
        method: "POST",
        headers: signed.headers,
        body,
    });

    console.log("response:", resp);

    if (!resp.ok) {
        throw new Error(`call failed: ${resp.status} ${await resp.text()}`);
    }
    return resp.json();
}

export default callFunctionUrl;