通过API更新Lambda函数环境变量时遇认证缺失错误的解决方法

你直接把ACCESS_KEY和SECRET_KEY拼接成Authorization头的方式完全不符合AWS的API认证规范，AWS所有REST API都要求使用**Signature Version 4（SigV4）**签名机制生成合法认证信息，这就是你收到"Missing Authentication Token"错误的核心原因。

推荐解决方案：使用AWS官方SDK（避免手动处理签名） #

手动实现SigV4签名逻辑复杂且容易出错，最稳妥的方式是用AWS官方SDK处理认证和请求。以下是用AWS SDK for JavaScript v3修改后的代码：

1. 先安装依赖：

npm install @aws-sdk/client-lambda @aws-sdk/credential-provider-node

2. 修改后的功能代码：

const { LambdaClient, UpdateFunctionConfigurationCommand } = require("@aws-sdk/client-lambda");
const { fromStatic } = require("@aws-sdk/credential-provider-node");

const AWS_REGION = 'myREGION';
const FUNCTION_NAME = 'myfn';
const ACCESS_KEY = 'myACCESS_KEY';
const SECRET_KEY = 'mySECRET_KEY';

const updateEnvironmentVariables = async () => {
  // 创建Lambda客户端，自动处理SigV4签名流程
  const lambdaClient = new LambdaClient({
    region: AWS_REGION,
    credentials: fromStatic({
      accessKeyId: ACCESS_KEY,
      secretAccessKey: SECRET_KEY
    })
  });

  // 构造更新函数配置的请求参数
  const command = new UpdateFunctionConfigurationCommand({
    FunctionName: FUNCTION_NAME,
    Environment: {
      Variables: {
        "API_KEY": "abc123",
        "DB_URL": "https://my.com/db"
      }
    }
  });

  try {
    const response = await lambdaClient.send(command);
    console.log('环境变量更新成功:', response);
  } catch (error) {
    console.error('更新失败:', error);
  }
};

// 调用更新函数
updateEnvironmentVariables();

若必须手动用fetch实现SigV4签名（不推荐） #

如果你因特殊需求必须用原生fetch发送请求，需要手动实现SigV4签名流程，核心步骤包括：

• 生成ISO8601格式的时间戳与日期字符串
• 构造规范请求（含HTTP方法、URL路径、请求头、请求体哈希等）
• 创建待签字符串（含签名算法、时间戳、区域、服务信息）
• 基于密钥生成签名密钥
• 计算HMAC-SHA256签名并构造Authorization头

以下是简化的实现框架（实际使用需完善细节）：

const crypto = require('crypto');

const generateSigV4AuthHeader = (method, url, body, accessKey, secretKey, region, service) => {
  const timestamp = new Date().toISOString().replace(/[:-]|\.\d{3}/g, '');
  const date = timestamp.slice(0, 8);
  
  // 1. 构造规范请求
  const urlObj = new URL(url);
  const canonicalUri = urlObj.pathname;
  const canonicalQueryString = urlObj.search.slice(1);
  const canonicalHeaders = `content-type:application/json\nhost:${urlObj.host}\nx-amz-date:${timestamp}\n`;
  const signedHeaders = 'content-type;host;x-amz-date';
  
  const payloadHash = crypto.createHash('sha256').update(body).digest('hex');
  const canonicalRequest = `${method}\n${canonicalUri}\n${canonicalQueryString}\n${canonicalHeaders}\n${signedHeaders}\n${payloadHash}`;
  
  // 2. 创建待签字符串
  const algorithm = 'AWS4-HMAC-SHA256';
  const credentialScope = `${date}/${region}/${service}/aws4_request`;
  const canonicalRequestHash = crypto.createHash('sha256').update(canonicalRequest).digest('hex');
  const stringToSign = `${algorithm}\n${timestamp}\n${credentialScope}\n${canonicalRequestHash}`;
  
  // 3. 生成签名密钥
  const kDate = crypto.createHmac('sha256', `AWS4${secretKey}`).update(date).digest();
  const kRegion = crypto.createHmac('sha256', kDate).update(region).digest();
  const kService = crypto.createHmac('sha256', kRegion).update(service).digest();
  const kSigning = crypto.createHmac('sha256', kService).update('aws4_request').digest();
  
  // 4. 计算签名并构造Authorization头
  const signature = crypto.createHmac('sha256', kSigning).update(stringToSign).digest('hex');
  return `${algorithm} Credential=${accessKey}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
};

// 使用示例
const updateEnvironmentVariables = async () => {
  const url = `https://lambda.${AWS_REGION}.amazonaws.com/2015-03-31/functions/${FUNCTION_NAME}/configuration`;
  const mybody = JSON.stringify({
    "environment": {
      "Variables": {
        "API_KEY": "abc123",
        "DB_URL": "https://my.com/db"
      }
    }
  });
  
  const authHeader = generateSigV4AuthHeader(
    'PUT', url, mybody, ACCESS_KEY, SECRET_KEY, AWS_REGION, 'lambda'
  );
  
  const response = await fetch(url, {
    method: 'PUT',
    headers: {
      'Content-Type': 'application/json',
      'x-amz-date': new Date().toISOString().replace(/[:-]|\.\d{3}/g, ''),
      'Authorization': authHeader,
    },
    body: mybody,
  }).then(v => v.json());
  
  console.log(response);
};

额外注意事项 #

• 确保你的ACCESS_KEY和SECRET_KEY对应的IAM用户拥有lambda:UpdateFunctionConfiguration权限，否则即使认证通过也会返回权限错误。
• 生产环境中不要硬编码凭证，建议使用IAM角色、环境变量或AWS凭证链（如~/.aws/credentials文件、ECS任务角色等）管理凭证。

内容的提问来源于stack exchange，提问作者Own Knitted Blank Wears