使用Lambda.from_function_arn在AWS CDK中配置带阶段变量的API网关端点失败

问题根源 #

CDK的LambdaIntegration会对传入的Lambda ARN执行严格格式校验，而带有动态阶段变量${stageVariables.lambdaAlias}的ARN不符合静态ARN的正则规则。跨栈引用Lambda时（通过from_function_arn获取的是只读Lambda对象），CDK会触发该校验导致报错；而同栈内创建Lambda时，直接拼接ARN的方式未触发严格校验，因此可以正常运行。

解决方案 #

方案一：使用AwsIntegration替代LambdaIntegration #

手动构造API网关调用Lambda的URI，支持动态阶段变量，绕过CDK的ARN校验：

from aws_cdk import (
    aws_lambda as lambda_,
    aws_apigateway as apigateway,
    aws_iam as iam,
    Fn,
    Stack
)

class UnifiedCrudStack(Stack):
    def __init__(self, scope, construct_id, **kwargs):
        super().__init__(scope, construct_id, **kwargs)
        
        # 跨栈导入Lambda ARN（推荐通过CfnOutput导出导入，避免硬编码）
        other_lambda_arn = Fn.import_value("OtherLambdaArn")
        other_lambda = lambda_.Function.from_function_arn(
            self,
            "OtherStackLambda",
            function_arn=other_lambda_arn
        )

        # 创建API网关调用Lambda所需的IAM角色
        api_lambda_role = iam.Role(
            self,
            "ApiLambdaInvokeRole",
            assumed_by=iam.ServicePrincipal("apigateway.amazonaws.com"),
            managed_policies=[
                iam.ManagedPolicy.from_aws_managed_policy_name("service-role/AWSLambdaRole")
            ]
        )

        # 构造包含阶段变量的Lambda调用URI
        lambda_invoke_uri = (
            f"arn:aws:apigateway:{self.region}:lambda:path/2015-03-31/functions/"
            f"{other_lambda.function_arn}:${{stageVariables.lambdaAlias}}/invocations"
        )

        # 使用AwsIntegration配置集成
        integration = apigateway.AwsIntegration(
            service="lambda",
            path=f"2015-03-31/functions/{other_lambda.function_arn}:${{stageVariables.lambdaAlias}}/invocations",
            integration_http_method="POST",  # API网关调用Lambda必须用POST
            options=apigateway.IntegrationOptions(
                credentials_role=api_lambda_role,
                request_templates={"application/json": '{"statusCode": 200}'}
            )
        )

        # 获取API网关并添加端点
        api = get_gateway(self.scope, gateway_name)
        root = api.root
        endpoint = root.resource_for_path("/test_other_lambda/").add_method("GET", integration)

        # 授予API网关角色调用Lambda的权限
        other_lambda.grant_invoke(api_lambda_role)

方案二：使用CDK逃逸舱修改集成URI #

先创建基础LambdaIntegration，再通过底层CloudFormation资源修改URI，绕过CDK层面的校验：

from aws_cdk import (
    aws_lambda as lambda_,
    aws_apigateway as apigateway,
    Fn,
    Stack
)

class UnifiedCrudStack(Stack):
    def __init__(self, scope, construct_id, **kwargs):
        super().__init__(scope, construct_id, **kwargs)
        
        # 跨栈导入Lambda ARN
        other_lambda_arn = Fn.import_value("OtherLambdaArn")
        other_lambda = lambda_.Function.from_function_arn(
            self,
            "OtherStackLambda",
            function_arn=other_lambda_arn
        )

        # 创建基础LambdaIntegration（不带阶段变量）
        integration = apigateway.LambdaIntegration(other_lambda)

        # 通过逃逸舱获取底层CloudFormation集成资源，修改URI
        cfn_integration = integration.node.default_child
        cfn_integration.uri = (
            f"arn:aws:apigateway:{self.region}:lambda:path/2015-03-31/functions/"
            f"{other_lambda.function_arn}:${{stageVariables.lambdaAlias}}/invocations"
        )

        # 获取API网关并添加端点
        api = get_gateway(self.scope, gateway_name)
        root = api.root
        endpoint = root.resource_for_path("/test_other_lambda/").add_method("GET", integration)

关键注意事项 #

• API网关调用Lambda必须使用POST作为集成请求方法，即使API对外暴露的是GET等其他方法。
• 确保API网关对应的IAM角色拥有目标Lambda的lambda:InvokeFunction权限（通过grant_invoke或手动配置策略实现）。
• 需在API网关的阶段配置中设置lambdaAlias变量，对应Lambda已存在的别名（如prod、dev）。
• 跨栈引用Lambda时，推荐通过CfnOutput导出ARN并在目标栈中导入，避免硬编码ARN，提升部署灵活性。

内容的提问来源于stack exchange，提问作者Tomás Santos