使用AWS CDK为HttpApi配置SQS集成时遇角色ARN必填错误

我正在使用AWS CDK构建包含HttpApi的CloudFormation堆栈，需为HttpApi配置与SQS的集成。代码片段如下：

import * as ApiGW2 from "@aws-cdk/aws-apigatewayv2-alpha";

const httpApi = new ApiGW2.HttpApi(this, "http-api", {
  apiName: "dev-api"
});

const int = new ApiGW2.HttpIntegration(this, "int1", {
  httpApi,
  integrationType: ApiGW2.HttpIntegrationType.AWS_PROXY,
  integrationSubtype: ApiGW2.HttpIntegrationSubtype.SQS_SEND_MESSAGE,
  payloadFormatVersion: ApiGW2.PayloadFormatVersion.VERSION_1_0,
})

运行代码时出现错误：

UPDATE_ROLLBACK_COMPLETE: Role ARN must be specified for AWS
integration configuration with Subtype: SQS-SendMessage

解决方法 #

要解决这个错误，你需要为API Gateway创建具备SQS发送权限的IAM角色，并在集成配置中指定该角色：

1. 创建IAM角色，允许API Gateway服务主体(apigateway.amazonaws.com)扮演该角色
2. 为角色添加sqs:SendMessage权限，限定到目标SQS队列
3. 在HttpIntegration配置中通过role属性指定这个角色
4. 配置requestParameters指定队列URL和消息体来源

完整示例代码：

import * as ApiGW2 from "@aws-cdk/aws-apigatewayv2-alpha";
import * as iam from "aws-cdk-lib/aws-iam";
import * as sqs from "aws-cdk-lib/aws-sqs";

// 创建或引用目标SQS队列
const targetQueue = new sqs.Queue(this, "TargetQueue");

const httpApi = new ApiGW2.HttpApi(this, "http-api", {
  apiName: "dev-api"
});

// 创建API Gateway调用SQS的IAM角色
const apiSqsIntegrationRole = new iam.Role(this, "ApiSqsIntegrationRole", {
  assumedBy: new iam.ServicePrincipal("apigateway.amazonaws.com"),
});

// 授予角色发送消息到指定队列的权限
apiSqsIntegrationRole.addToPolicy(new iam.PolicyStatement({
  actions: ["sqs:SendMessage"],
  resources: [targetQueue.queueArn],
}));

// 配置HttpIntegration，指定角色和请求参数
const sqsIntegration = new ApiGW2.HttpIntegration(this, "SqsSendMessageIntegration", {
  httpApi,
  integrationType: ApiGW2.HttpIntegrationType.AWS_PROXY,
  integrationSubtype: ApiGW2.HttpIntegrationSubtype.SQS_SEND_MESSAGE,
  payloadFormatVersion: ApiGW2.PayloadFormatVersion.VERSION_1_0,
  role: apiSqsIntegrationRole,
  requestParameters: {
    "QueueUrl": targetQueue.queueUrl,
    "MessageBody": "$request.body" // 从API请求体获取消息内容，可按需调整
  }
});

// 关联路由与集成
httpApi.addRoutes({
  path: "/send-to-sqs",
  methods: [ApiGW2.HttpMethod.POST],
  integration: sqsIntegration,
});

关键说明 #

• AWS_PROXY类型的集成必须指定IAM角色，因为API Gateway需要通过该角色获得调用SQS的权限
• 角色信任策略必须包含apigateway.amazonaws.com服务主体，确保API Gateway可以扮演该角色
• 权限要最小化，仅授予sqs:SendMessage且限定到目标队列的ARN
• requestParameters是必填项，用于告诉API Gateway要发送消息到哪个队列，以及消息内容的来源

内容的提问来源于stack exchange，提问作者Aleksand Kondaurov