AWS AppSync GraphQL Java客户端通过RestTemplate配置IAM授权的方法

标注了@aws_iam的AWS GraphQL（通常是AppSync服务）端点要求请求使用AWS SigV4签名校验，不再识别x-api-key授权头，你需要对请求完成签名后携带签名生成的认证头发起调用，具体修改步骤如下：

第一步：引入必要依赖 #

以Maven为例，引入AWS SDK核心包用于签名能力：

<dependency>
    <groupId>com.amazonaws</groupId>
    <artifactId>aws-java-sdk-core</artifactId>
    <version>1.12.650</version> <!-- 替换为最新稳定版即可 -->
</dependency>

第二步：核心代码修改 #

无需硬编码AWS密钥，通过默认凭证链自动读取环境变量、本地配置文件、服务关联IAM角色等凭证，对请求完成SigV4签名后发起调用：

import com.amazonaws.DefaultRequest;
import com.amazonaws.auth.AWS4Signer;
import com.amazonaws.auth.AWSCredentialsProvider;
import com.amazonaws.auth.DefaultAWSCredentialsProviderChain;
import com.amazonaws.http.HttpMethodName;
import org.springframework.http.HttpEntity;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.http.ResponseEntity;
import org.springframework.web.client.RestTemplate;
import java.net.URI;
import java.nio.charset.StandardCharsets;

public class IamAuthGraphqlClient {
    // 替换为你端点所在的AWS区域，例如cn-north-1
    private static final String AWS_REGION = "你的AWS区域";
    // AppSync服务固定签名服务名为appsync，若你的端点托管在API Gateway则改为execute-api
    private static final String SERVICE_NAME = "appsync";
    // 替换为你的GraphQL接口地址
    private static final String ENDPOINT_URL = "你的GraphQL端点地址";

    public String callIamAuthGraphql(String query) throws Exception {
        RestTemplate restTemplate = new RestTemplate();
        // 1. 自动获取AWS凭证
        AWSCredentialsProvider credentialsProvider = DefaultAWSCredentialsProviderChain.getInstance();

        // 2. 初始化SigV4签名器
        AWS4Signer signer = new AWS4Signer();
        signer.setRegionName(AWS_REGION);
        signer.setServiceName(SERVICE_NAME);

        // 3. 构建待签名的请求对象
        DefaultRequest<Void> awsSignRequest = new DefaultRequest<>(SERVICE_NAME);
        awsSignRequest.setHttpMethod(HttpMethodName.POST);
        awsSignRequest.setEndpoint(new URI(ENDPOINT_URL));
        awsSignRequest.setContent(new java.io.ByteArrayInputStream(query.getBytes(StandardCharsets.UTF_8)));
        // 签名需要包含Content-Type头
        awsSignRequest.addHeader("Content-Type", "application/graphql");

        // 4. 执行签名，自动注入认证相关头
        signer.sign(awsSignRequest, credentialsProvider.getCredentials());

        // 5. 把签名完成的头复制到RestTemplate请求头中
        HttpHeaders requestHeaders = new HttpHeaders();
        awsSignRequest.getHeaders().forEach(requestHeaders::set);

        // 6. 发起请求
        HttpEntity<String> requestEntity = new HttpEntity<>(query, requestHeaders);
        ResponseEntity<String> response = restTemplate.exchange(
                ENDPOINT_URL,
                HttpMethod.POST,
                requestEntity,
                String.class
        );
        return response.getBody();
    }
}

注意事项 #

• 确保调用客户端的身份（本地开发的AWS配置凭证、ECS任务角色、Lambda执行角色等）已附加包含appsync:GraphQL操作权限的IAM策略，否则签名成功也会返回403
• 无需再添加x-api-key请求头，签名完成后会自动生成Authorization、X-Amz-Date等必要的认证头

内容的提问来源于stack exchange，提问作者Manushi