基于AWS CDKv2实现Cognito注册时上传头像至S3的问题

核心问题梳理 #

1. Cognito sign-up API不支持直接传递二进制文件，只能通过Base64编码字符串存入用户属性传递
2. 你之前的Lambda代码错误在于把picture属性当成文件对象处理，但实际它是Base64字符串；且PreSignup触发器时机过早（用户未完成注册），改用PostConfirmation触发器更稳妥

分步实现方案 #

1. 修正Lambda处理逻辑（PostConfirmation触发器） #

用户成功注册后触发，完成Base64解码、S3上传、用户属性更新：

import boto3
import base64
import os
from botocore.exceptions import ClientError

s3 = boto3.client('s3')
cognito_idp = boto3.client('cognito-idp')

def handler(event, context):
    username = event['userName']
    user_pool_id = event['userPoolId']
    base64_image = event['request']['userAttributes'].get('picture')
    
    if not base64_image:
        return event
    
    try:
        # 解析Base64头部和内容
        header, encoded = base64_image.split(',', 1)
        file_type = header.split(';')[0].split('/')[1].lower()
        content_type = f'image/{file_type}'
        
        # 解码为二进制数据
        image_data = base64.b64decode(encoded)
        
        # 上传至S3
        bucket_name = os.environ['BUCKET_NAME']
        s3_key = f'profile-pictures/{username}.{file_type}'
        s3.put_object(
            Bucket=bucket_name,
            Key=s3_key,
            Body=image_data,
            ContentType=content_type
        )
        
        # 生成S3访问链接（建议用预签名URL替代公网链接，此处为示例）
        s3_url = f'https://{bucket_name}.s3.{os.environ["AWS_REGION"]}.amazonaws.com/{s3_key}'
        
        # 更新Cognito自定义属性存储链接
        cognito_idp.update_user_attributes(
            UserPoolId=user_pool_id,
            Username=username,
            UserAttributes=[{'Name': 'custom:profilePicture', 'Value': s3_url}]
        )
        
    except Exception as e:
        print(f"处理头像失败: {str(e)}")
    
    return event

2. CDKv2基础设施代码（Python） #

创建用户池、S3桶、Lambda触发器并配置权限：

from aws_cdk import (
    Stack,
    aws_cognito as cognito,
    aws_s3 as s3,
    aws_lambda as _lambda,
    aws_iam as iam,
    Duration,
    RemovalPolicy
)
from constructs import Construct

class CognitoAvatarStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        
        # 创建S3桶（禁用公网访问，后续可通过预签名URL访问）
        avatar_bucket = s3.Bucket(
            self, "AvatarBucket",
            block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
            encryption=s3.BucketEncryption.S3_MANAGED,
            removal_policy=RemovalPolicy.RETAIN
        )
        
        # 创建处理头像的Lambda
        avatar_lambda = _lambda.Function(
            self, "AvatarHandler",
            runtime=_lambda.Runtime.PYTHON_3_11,
            code=_lambda.Code.from_asset("lambda"), # Lambda代码放在项目根目录的lambda文件夹下
            handler="handler.handler",
            environment={
                "BUCKET_NAME": avatar_bucket.bucket_name,
                "AWS_REGION": self.region
            },
            timeout=Duration.seconds(10)
        )
        
        # 给Lambda赋予S3上传权限
        avatar_bucket.grant_put(avatar_lambda)
        
        # 给Lambda赋予Cognito用户属性更新权限
        avatar_lambda.add_to_role_policy(iam.PolicyStatement(
            actions=["cognito-idp:UpdateUserAttributes"],
            resources=[f"arn:aws:cognito-idp:{self.region}:{self.account}:userpool/*"]
        ))
        
        # 创建Cognito用户池
        user_pool = cognito.UserPool(
            self, "UserPool",
            self_sign_up_enabled=True,
            auto_verify=cognito.AutoVerifiedAttrs(email=True),
            # 启用标准属性picture用于接收Base64头像
            standard_attributes=cognito.StandardAttributes(
                picture=cognito.StandardAttribute(required=False, mutable=True)
            ),
            # 添加自定义属性存储S3链接
            custom_attributes={
                "profilePicture": cognito.StringAttribute(mutable=True)
            },
            # 绑定PostConfirmation触发器
            lambda_triggers=cognito.UserPoolTriggers(post_confirmation=avatar_lambda)
        )
        
        # 可选：创建用户池客户端
        user_pool.add_client(
            "UserPoolClient",
            auth_flows=cognito.AuthFlow(user_password=True)
        )

3. 前端调用示例 #

将图片转为Base64后，通过Cognito sign-up API传递：

// 读取本地图片并转为Base64
const fileInput = document.getElementById('avatar-input');
const file = fileInput.files[0];

const reader = new FileReader();
reader.onload = (e) => {
    const base64Avatar = e.target.result;
    
    // 调用Amplify Auth的signUp方法（或直接调用Cognito API）
    Auth.signUp({
        username: 'your-email@example.com',
        password: 'YourStrongPassword123!',
        attributes: {
            picture: base64Avatar // 传递Base64编码的头像
        }
    });
};
reader.readAsDataURL(file);

关键注意事项 #

• 触发器时机：PostConfirmation在用户注册成功后触发，避免注册失败时产生无效的S3文件
• S3权限：禁止给桶开公网读权限，建议通过预签名URL或API Gateway+Lambda提供图片访问
• Base64大小限制：Cognito单属性最大2048字节，仅适合小尺寸头像；大图片建议先传S3再把链接传给Cognito
• 错误处理：Lambda中添加异常捕获，避免中断用户注册流程

内容的提问来源于stack exchange，提问作者user20519169