如何通过AWS CLI为ALB监听器添加Cognito用户池认证

前提准备 #

先提前定义好所需变量（替换成你的实际ARN/ID）：

ALB_ARN="arn:aws:elasticloadbalancing:区域:账号ID:loadbalancer/app/你的ALB名称/xxx"
# 若修改现有监听器，需定义此变量
LISTENER_ARN="arn:aws:elasticloadbalancing:区域:账号ID:listener/app/你的ALB名称/xxx/xxx"
TG_ARN="arn:aws:elasticloadbalancing:区域:账号ID:targetgroup/你的TG名称/xxx"
CERTIFICATE_ARN="arn:aws:acm:区域:账号ID:certificate/xxx"
COGNITO_USER_POOL_ARN="arn:aws:cognito-idp:区域:账号ID:userpool/xxx"
COGNITO_CLIENT_ID="你的Cognito用户池客户端ID"

方法一：给现有443 HTTPS监听器添加Cognito认证 #

使用modify-listener命令更新监听器的默认动作，将认证步骤放在转发动作之前：

aws elbv2 modify-listener \
  --listener-arn $LISTENER_ARN \
  --default-actions '[
    {
      "Type": "authenticate-cognito",
      "AuthenticateCognitoConfig": {
        "UserPoolArn": "'"$COGNITO_USER_POOL_ARN"'",
        "UserPoolClientId": "'"$COGNITO_CLIENT_ID"'",
        "UserPoolDomain": "你的Cognito用户池域名",
        "Scope": "openid",
        "OnUnauthenticatedRequest": "authenticate"
      },
      "Order": 1
    },
    {
      "Type": "forward",
      "TargetGroupArn": "'"$TG_ARN"'",
      "Order": 2
    }
  ]'

说明：UserPoolDomain是你的Cognito用户池配置的域名（例如xxx.auth.区域.amazoncognito.com）；OnUnauthenticatedRequest可选值为authenticate（跳转认证）、deny（返回401）、allow（直接放行），可按需调整。

方法二：新建带Cognito认证的443 HTTPS监听器 #

如果不想修改现有监听器，直接创建新的HTTPS监听器并配置认证：

aws elbv2 create-listener \
  --load-balancer-arn $ALB_ARN \
  --protocol HTTPS \
  --port 443 \
  --certificates CertificateArn=$CERTIFICATE_ARN \
  --default-actions '[
    {
      "Type": "authenticate-cognito",
      "AuthenticateCognitoConfig": {
        "UserPoolArn": "'"$COGNITO_USER_POOL_ARN"'",
        "UserPoolClientId": "'"$COGNITO_CLIENT_ID"'",
        "UserPoolDomain": "你的Cognito用户池域名",
        "Scope": "openid",
        "OnUnauthenticatedRequest": "authenticate"
      },
      "Order": 1
    },
    {
      "Type": "forward",
      "TargetGroupArn": "'"$TG_ARN"'",
      "Order": 2
    }
  ]'

验证配置 #

执行以下命令查看监听器的动作配置，确认认证规则已生效：

# 针对现有监听器
aws elbv2 describe-listeners --listener-arns $LISTENER_ARN
# 针对新建监听器，先获取ARN再查询
aws elbv2 describe-listeners --load-balancer-arn $ALB_ARN

内容的提问来源于stack exchange，提问作者Revan