如何通过Terraform配置API Gateway不同阶段调用对应Lambda函数

修改步骤 #

• 首先修改aws_apigatewayv2_integration资源的integration_uri参数，将Lambda函数名部分替换为阶段变量占位符
• 新增Lambda调用权限配置，允许API Gateway调用两个环境的Lambda函数
• 原有阶段配置的stage_variables无需修改

完整修改后代码 #

# 新增：获取当前AWS账号和区域信息，避免硬编码
data "aws_caller_identity" "current" {}
data "aws_region" "current" {}

resource "aws_apigatewayv2_api" "app_http_api_gateway" {
  name          = "app-http-api"
  protocol_type = "HTTP"
}

resource "aws_apigatewayv2_integration" "app_http_api_integration" {
  api_id                    = aws_apigatewayv2_api.app_http_api_gateway.id
  integration_type          = "AWS_PROXY"
  connection_type           = "INTERNET"
  description               = "Lambda integration"
  integration_method        = "POST"
  # 修改：使用阶段变量占位符替换固定的Lambda ARN
  integration_uri           = "arn:aws:apigateway:${data.aws_region.current.name}:lambda:path/2015-03-31/functions/arn:aws:lambda:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:function:${stageVariables.lambda_function}/invocations"
  passthrough_behavior      = "WHEN_NO_MATCH"
}

resource "aws_apigatewayv2_route" "app_http_api_gateway_resource_route" {
  api_id    = aws_apigatewayv2_api.app_http_api_gateway.id
  route_key = "ANY /{resource}"
  target    = "integrations/${aws_apigatewayv2_integration.app_http_api_integration.id}"
}

# 新增：允许API Gateway调用开发环境Lambda
resource "aws_lambda_permission" "dev_lambda_apigw_access" {
  statement_id  = "AllowAPIGatewayInvokeDev"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.app_lambda_development.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_apigatewayv2_api.app_http_api_gateway.execution_arn}/*/*/*"
}

# 新增：允许API Gateway调用生产环境Lambda
resource "aws_lambda_permission" "prod_lambda_apigw_access" {
  statement_id  = "AllowAPIGatewayInvokeProd"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.app_lambda_production.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_apigatewayv2_api.app_http_api_gateway.execution_arn}/*/*/*"
}

resource "aws_apigatewayv2_stage" "app_http_api_gateway_development" {
  api_id            = aws_apigatewayv2_api.app_http_api_gateway.id
  name              = "development"
  auto_deploy       = true
  stage_variables   = {
    lambda_function = aws_lambda_function.app_lambda_development.function_name
  }
}

resource "aws_apigatewayv2_stage" "app_http_api_gateway_production" {
  api_id            = aws_apigatewayv2_api.app_http_api_gateway.id
  name              = "production"
  auto_deploy       = true
  stage_variables   = {
    lambda_function = aws_lambda_function.app_lambda_production.function_name
  }
}

实现逻辑 #

当API Gateway接收到不同阶段的请求时，会自动将集成URI中的${stageVariables.lambda_function}替换为对应阶段配置的Lambda函数名，实现不同阶段调用不同函数的效果。新增的Lambda权限是为了确保API Gateway有资格调用两个环境的Lambda函数，避免调用时出现权限错误。

内容的提问来源于stack exchange，提问作者Dan