多Lambda微服务共享ApiGateway自定义域名部署失败问题咨询

Absolutely! You totally can share a single custom domain across multiple Lambda-based microservices by mapping unique base paths to each one—this is a super common pattern with AWS API Gateway, and it’ll fix that CloudFormation rollback issue you’re hitting. Here’s how to set it up properly:

Core Concept #

The problem you’re facing happens because each microservice template was trying to create the same custom domain resource (AWS::ApiGateway::DomainName), which AWS doesn’t allow (you can’t have duplicate domain name resources in the same account/region). Instead, you need to:

1. Create the custom domain once in a shared CloudFormation stack.
2. For each microservice, create a base path mapping that links a unique path (like /service1 or /service2) to that microservice’s API Gateway stage.

Step-by-Step Implementation #

1. Create a Shared Custom Domain Stack #

First, make a standalone CloudFormation stack for your shared custom domain. This stack only needs to be deployed once, and all microservices will reference it. Example template:

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  SharedApiDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      DomainName: "api.yourdomain.com" # Replace with your actual domain
      CertificateArn: "arn:aws:acm:us-east-1:123456789012:certificate/your-cert-arn" # ACM cert for your domain
      EndpointConfiguration:
        Types:
          - REGIONAL # Or EDGE if you need global distribution

Outputs:
  SharedDomainName:
    Value: !Ref SharedApiDomain
    Export:
      Name: "SharedApiDomain-Name"
  SharedDomainArn:
    Value: !GetAtt SharedApiDomain.DomainName
    Export:
      Name: "SharedApiDomain-Arn"

Deploy this stack first—this creates your custom domain without tying it to any single microservice.

2. Update Microservice #1’s Template #

Modify your existing microservice #1 template to remove any AWS::ApiGateway::DomainName resource (since we’re using the shared one), then add a base path mapping for its unique path (e.g., /service1):

# Existing ApiGatewayApi resource remains unchanged
ApiGatewayApi:
  Type: AWS::ApiGateway::RestApi
  # ... your existing properties ...

# Add this base path mapping resource
Service1BasePathMapping:
  Type: AWS::ApiGateway::BasePathMapping
  Properties:
    DomainName: !ImportValue "SharedApiDomain-Name"
    RestApiId: !Ref ApiGatewayApi
    Stage: "Prod" # Replace with your API stage name (e.g., dev, prod)
    BasePath: "service1" # Unique path for this microservice

When you deploy this updated template, it’ll map your first microservice to api.yourdomain.com/service1.

3. Deploy Microservice #2’s Template #

For your second microservice, do the same: add a base path mapping with a unique path (e.g., /service2), referencing the shared domain. Example:

# Microservice #2's API Gateway resource
ApiGatewayApiService2:
  Type: AWS::ApiGateway::RestApi
  # ... your properties ...

# Base path mapping for service 2
Service2BasePathMapping:
  Type: AWS::ApiGateway::BasePathMapping
  Properties:
    DomainName: !ImportValue "SharedApiDomain-Name"
    RestApiId: !Ref ApiGatewayApiService2
    Stage: "Prod"
    BasePath: "service2" # Unique path for this microservice

This deployment won’t conflict with the first one because each base path mapping uses a distinct path under the same shared domain.

Key Notes to Avoid Issues #

• ACM Certificate Requirements: If using a REGIONAL endpoint, your ACM certificate must be in the same region as your API Gateway. For EDGE endpoints, the certificate must be in us-east-1.
• Stage Existence: Make sure your API Gateway has the stage (e.g., Prod) created before deploying the base path mapping—you can include the stage in your microservice template if it’s not already there.
• CloudFormation Permissions: Ensure the IAM role used to deploy your microservice stacks has permission to import values from the shared domain stack.
• Route53 (Optional): If you want to map your custom domain to the API Gateway endpoint, add a Route53 record in the shared stack pointing to the domain’s distribution domain name (from !GetAtt SharedApiDomain.DistributionDomainName for EDGE, or RegionalDomainName for REGIONAL).

内容的提问来源于stack exchange，提问作者Kwhitejr