使用Java AWS SDK调用AWS API Gateway Websocket API时遇403错误排查

核心问题：端点URL格式错误 #

你代码里的endpointOverride配置有误，正确的API Gateway Management API端点应该是不带/@connections后缀的，格式为：
https://{api-id}.execute-api.{region}.amazonaws.com/{stage}

你当前的端点写成了https://api-id.execute-api.us-west-2.amazonaws.com/@connections/stage，这会导致SDK生成的请求路径与实际需要的路径不匹配，进而引发签名验证失败，返回403错误。而Postman中你应该是手动构造了正确的请求URL（比如https://api-id.execute-api.us-west-2.amazonaws.com/stage/@connections/{connectionId}），所以签名验证通过。

修正后的代码 #

AwsSessionCredentials awsCreds = AwsSessionCredentials.create(
        "***********",
        "*********",
        "**********"
);

AwsCredentialsProvider credentialsProvider = StaticCredentialsProvider.create(awsCreds);

// 修正端点URL，只保留API网关的stage级地址
ApiGatewayManagementApiClient testApiClient = ApiGatewayManagementApiClient.builder()
        .region(Region.US_WEST_2)
        .credentialsProvider(credentialsProvider)
        .endpointOverride(new URI("https://api-id.execute-api.us-west-2.amazonaws.com/stage"))
        .build();

String connectionId = "********";

GetConnectionResponse getResponse = testApiClient.getConnection(GetConnectionRequest.builder()
        .connectionId(connectionId)
        .build());

PostToConnectionResponse postResponse = testApiClient.postToConnection(PostToConnectionRequest.builder()
        .connectionId(connectionId)
        .data(SdkBytes.fromUtf8String("test message from Spring"))
        .build());

额外验证点 #

• 确认IAM凭证的权限包含execute-api:Invoke动作，并且资源路径匹配arn:aws:execute-api:us-west-2:你的账号ID:api-id/stage/POST/@connections/*和arn:aws:execute-api:us-west-2:你的账号ID:api-id/stage/GET/@connections/*
• 检查SDK版本是否为最新，避免旧版本的签名逻辑问题

内容的提问来源于stack exchange，提问作者Preston Reed