自定义Lambda授权器无法生效且无CloudWatch日志，求排查

问题描述 #

配置了极简的HTTP API Gateway Lambda授权器，预期允许所有请求访问受保护的/books资源，但实际所有请求都无法通过授权，且授权器Lambda没有生成任何CloudWatch日志。

相关代码 #

CDK 部署代码（TypeScript） #

import * as cdk from 'aws-cdk-lib';
import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2'
import * as lambda from 'aws-cdk-lib/aws-lambda'
import * as authorizers from 'aws-cdk-lib/aws-apigatewayv2-authorizers'
import * as integrations from 'aws-cdk-lib/aws-apigatewayv2-integrations'

export class ApigwCustomAuthLambdaStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const httpApi = new apigwv2.HttpApi(this, "HttpProxyApi", {
      createDefaultStage: true,
    })

    const authFunction = new lambda.Function(this, 'BooksAuthorizer', {
      runtime: lambda.Runtime.NODEJS_18_X,
      code: lambda.Code.fromAsset("handlers/auth"),
      handler: "auth.handler",
    })

    const booksAuthorizer = new authorizers.HttpLambdaAuthorizer('LambdaAuth', authFunction, {
      responseTypes:[authorizers.HttpLambdaResponseType.SIMPLE]
    })
    
    const booksFunction = new lambda.Function(this, 'BooksFunction', {
      runtime: lambda.Runtime.NODEJS_18_X,
      code: lambda.Code.fromAsset("handlers/books"),
      handler: "books.handler"
    })

    const booksIntegration = new integrations.HttpLambdaIntegration("LambdaIntegration", booksFunction)
    
    httpApi.addRoutes({
      integration: booksIntegration,
      methods: [apigwv2.HttpMethod.GET],
      path: "/books",
      authorizer: booksAuthorizer
    })
  }
}

授权器Lambda代码（JavaScript） #

console.log('Loading function');
export handler = (event) => {
  const response = {
    "isAuthorized": true
  }
  return response;
};

错误排查与修复方案 #

1. Lambda授权器代码语法错误 #

授权器Lambda的导出语法不符合Node.js规范，export handler = ... 属于语法错误，会导致Lambda无法加载处理程序，直接执行失败，因此不会生成日志也无法返回授权结果。

修复： 修正为标准ES模块导出语法：

console.log('Loading function');
export const handler = (event) => {
  const response = {
    "isAuthorized": true
  };
  return response;
};

2. CDK构造函数参数类型错误 #

CDK栈构造函数中的scope: Construct未正确引用类型，CDK v2依赖constructs库的Construct，未显式导入会导致类型错误，可能引发部署过程中的资源配置异常。

修复：

• 方案一：在文件顶部添加Construct导入：

  import { Construct } from 'constructs';
  

• 方案二：将参数类型改为cdk.Construct：

  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps)
  

3. 验证API Gateway调用授权器的权限 #

虽然CDK的HttpLambdaAuthorizer通常会自动添加API Gateway调用授权器Lambda的权限，但部署异常可能导致权限缺失，可手动添加确保触发权限：

添加权限代码（CDK）：

authFunction.addPermission('ApiGatewayInvokePermission', {
  principal: new cdk.aws_iam.ServicePrincipal('apigateway.amazonaws.com'),
  action: 'lambda:InvokeFunction',
  sourceArn: httpApi.arnForExecuteApi('*', '/books', 'GET'),
});

4. 确认Lambda日志权限 #

授权器Lambda需要具备写入CloudWatch Logs的权限，CDK默认创建的Lambda会自动附加AWSLambdaBasicExecutionRole策略（包含日志相关权限）。如果自定义了Lambda执行角色，需确保角色包含以下权限：

• logs:CreateLogGroup
• logs:CreateLogStream
• logs:PutLogEvents

测试步骤 #

1. 部署修复后的CDK栈
2. 发送GET请求到/books端点
3. 查看授权器Lambda的CloudWatch日志组，确认日志是否生成
4. 验证请求是否成功通过授权并返回业务响应

内容的提问来源于stack exchange，提问作者Colin