使用CDK部署API Gateway：Hosted Zone ID不匹配及域名疑问

背景信息 #

我正在用CDK部署AWS API Gateway：

• 创建的API网关关联的托管区域ID为Z1UJRXOUMOOFQ8
• 我的Route 53账户下只有一个托管区域，ID为Z07841403UX33F69270EK

问题 #

1. 为什么这两个托管区域ID不匹配？我原本以为API网关的托管区域ID应该和Route 53里的一致，但找不到这个API网关托管区域ID的来源。
2. API网关截图里显示的域名d-mtr****.execute-api.us-east-1.amazonaws.com，和CDK部署输出的域名https://mmz****.execute-api.us-east-1.amazonaws.com/prod/不一致。

代码 #

package.json依赖 #

"dependencies": {
    "@aws-cdk/aws-apigatewayv2": "^1.180.0",
    "@aws-cdk/aws-apigatewayv2-alpha": "^2.50.0-alpha.0",
    "@aws-cdk/aws-apigatewayv2-integrations": "^1.180.0",
    "@aws-cdk/aws-apigatewayv2-integrations-alpha": "^2.50.0-alpha.0",
    "aws-cdk-lib": "^2.46.0",
    "constructs": "^10.1.156",
    "source-map-support": "^0.5.21"
  }

API Gateway Stack代码 #

import * as CDK from "aws-cdk-lib";

import * as CertificateManager from "aws-cdk-lib/aws-certificatemanager";
import * as Route53 from "aws-cdk-lib/aws-route53";
import * as Route53Targets from "aws-cdk-lib/aws-route53-targets";
import * as ApiGateway from "aws-cdk-lib/aws-apigateway";

import * as ELBv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
import { Construct } from "constructs";
import { ALPHA, StageInfo } from "../config/stage-config";
import * as Cognito from "aws-cdk-lib/aws-cognito";

export class ApigatewayStack extends CDK.Stack {
  // Prefix for CDK constrcut ID
  private readonly constructIdPrefix: string;
  private readonly domainCertificate: CertificateManager.Certificate;
  private readonly businessAccountAuthorizer: ApiGateway.CfnAuthorizer;
  public readonly restApi: ApiGateway.RestApi;
  constructor(scope: Construct, id: string, props: ApigatewayStackProps) {
    super(scope, id, props);

    this.constructIdPrefix = `${props.packageName}-${props.stageInfo.stageName}`;

    const hostedZone: Route53.IHostedZone = Route53.HostedZone.fromLookup(
      this,
      `${this.constructIdPrefix}-HostedZoneLookup`,
      {
        domainName: props.stageInfo.domainName,
      }
    );

    this.domainCertificate = new CertificateManager.Certificate(
      this,
      `${this.constructIdPrefix}-restApiCertificate`,
      {
        certificateName: "certificateForRestApi",
        domainName: props.stageInfo.domainName,
        validation: CertificateManager.CertificateValidation.fromDns(hostedZone),
      }
    );

    this.restApi = new ApiGateway.RestApi(
      this,
      `${this.constructIdPrefix}-restApi`,
      {
        restApiName: "restApi",
        description: "The centralized API for example.com",
        domainName: {
          domainName: props.stageInfo.domainName,
          certificate: this.domainCertificate,
          //mappingKey: props.pipelineStageInfo.stageName
        },

        defaultCorsPreflightOptions: {
          allowOrigins: ApiGateway.Cors.ALL_ORIGINS,
          allowMethods: ApiGateway.Cors.ALL_METHODS
        },
      }
    );

    new Route53.ARecord(this, "AliasRecordForRestApi", {
      recordName: "AliasRecordForRestApi",
      deleteExisting: true, // delete existing one instead of doing it manually later
      zone: hostedZone,
      target: Route53.RecordTarget.fromAlias(
        new Route53Targets.ApiGateway(this.restApi)
      ),
      // or - route53.RecordTarget.fromAlias(new alias.ApiGatewayDomain(domainName)),
    });

   // Irrelevant code is hidden
}

更新说明 #

我已经修正了一个低级错误：代码里的recordName应该设置为域名，之前误以为它只是Route53记录的名称标识。修改后部署已正常工作，但仍不清楚为什么第一张截图里的托管区域ID在我的Route53中找不到。

解答 #

关于托管区域ID不匹配的问题 #

Z1UJRXOUMOOFQ8是AWS托管的API Gateway服务专用托管区域，不属于你的AWS账户。当你创建API Gateway自定义域名时，AWS会自动将该域名的解析指向这个服务托管区域——它由AWS负责维护，用于处理API Gateway的流量路由，所以你在自己的Route53控制台里看不到它。

你的自定义域名通过Route53别名记录指向这个AWS托管区域，确保流量能正确路由到你的API实例。

关于域名不一致的问题 #

• 截图里的d-mtr****.execute-api.us-east-1.amazonaws.com是API Gateway的内部默认域名，属于AWS服务域，是API实例的原生访问地址。
• CDK输出的https://mmz****.execute-api.us-east-1.amazonaws.com/prod/是带部署阶段的访问地址，其中prod是你配置的API部署阶段路径。修正recordName后，你最终应该通过自定义域名访问API，而非这两个AWS提供的默认域名。

这两个域名本质指向同一个API实例，只是访问标识和路径不同，前者用于AWS内部路由，后者是按阶段划分的访问入口。

内容的提问来源于stack exchange，提问作者Yang Liu