Amazon web services CloudFront 403禁止异常（AWS SAM模板）

我正在使用AWS SAM Cli和模板部署一个无服务器应用程序，但API网关资源在尝试curl/postman时返回403 ForbiddenException错误。我试着在网上查找，但没有找到任何解决我问题的答案，我想知道这里是否有人曾经遇到过这种情况

template.yaml：

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31


Globals:
  Function:
    Runtime: nodejs10.x
    MemorySize: 256

  Api:
    Cors:
      AllowMethods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
      AllowHeaders: "'Content-Type,X-Amz-Date,X-Amz-Security-Token,Authorization,X-Api-Key,X-Requested-With,Accept,Access-Control-Allow-Methods,Access-Control-Allow-Origin,Access-Control-Allow-Headers'"
      AllowOrigin: "'*'"

Parameters:
  ApiKey:
    Type: String
    Default: none

Conditions:
  CreateApiKey: !Not [!Equals [!Ref ApiKey, 'none']]

Resources:
  # DynamoDB table setup
  DyanmoDBStoryTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Stories
      AttributeDefinitions:
        - AttributeName: short_id
          AttributeType: S
      KeySchema:
        - AttributeName: short_id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 0
        WriteCapacityUnits: 0
      BillingMode: PAY_PER_REQUEST

  # Log group
  DynamoSaveStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoSaveStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoSaveStoryLambda}'
  DynamoGetStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoGetStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoGetStoryLambda}'
  DynamoUpdateStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoUpdateStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoUpdateStoryLambda}'

  # Lambda Fn
  DynamoSaveStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/save-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story
            Method: post

  DynamoGetStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/get-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story/{shortId}
            Method: get

  DynamoUpdateStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/update-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story/{shortId}
            Method: post

  # Custom API gateway setup API Keys & usage plans
  ApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        ApiKeyRequired: true

  UsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    DependsOn: [ApiGatewayProdStage]
    Condition: CreateApiKey
    Properties:
      ApiStages:
        - ApiId: !Ref ApiGateway
          Stage: Prod

  DynamoLambdasApiKey:
    Type: AWS::ApiGateway::ApiKey
    DependsOn: [UsagePlan]
    Condition: CreateApiKey
    Properties:
      Value: !Ref ApiKey
      Enabled: true
      StageKeys:
        - RestApiId: !Ref ApiGateway
          StageName: Prod

  UsagePlanKey:
    Type: AWS::ApiGateway::UsagePlanKey
    Condition: CreateApiKey
    Properties:
      KeyId: !Ref DynamoLambdasApiKey
      KeyType: API_KEY
      UsagePlanId: !Ref UsagePlan

Outputs:
  StoryApi:
    Description: Serverless api url generated by AWS Cloudformation upon stack deployment
    Value: !Sub 'https://${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com/prod'
  ApiKey:
    Description: Api key to authorize access in API Gateway
    Value: !Ref ApiKey

SAM CLI版本：0.47.0

错误：

Date →Sun, 26 Apr 2020 19:22:02 GMT
Content-Type →application/json
Content-Length →23
Connection →keep-alive
x-amzn-RequestId →01d6b9ec-dcf0-484c-be07-6b629437b305
x-amzn-ErrorType →ForbiddenException
x-amz-apigw-id →Lm_WOF9ZvHcF7nQ=

直接从AWS Lambda控制台测试它可以正常工作，并且会生成cloudwatch日志，但当我使用部署期间生成的API url对请求进行curl/postman处理时，情况并非如此。我尝试了以下方法：

• 确保正确设置

  x-api-key

  标题，并验证AWS控制台中的api网关是否设置了正确的api密钥
• 在模板的全局API中配置CORS。确认它将在API网关控制台中创建

  选项

  端点
• 仔细检查端点是否正确

---

错误表明这是cloudfront问题，因此我已经确认S3存储桶具有公共访问权限。AWS控制台中没有其他cloudfront资源。我不知道是什么阻止了请求。

答案比我想象的要简单，但对于遇到这个问题的任何人来说，查询参数都是区分大小写的。无服务器应用程序模型部署的输出url返回

https://${serverlessAppId}.execute api.${region}.amazonaws.com/${StageName}

---

在我的例子中，

StageName

是

Prod

，我作为

Prod

发出请求的答案比我想象的要简单，但是对于遇到这个问题的任何人来说，查询参数都是区分大小写的。无服务器应用程序模型部署的输出url返回

https://${serverlessAppId}.execute api.${region}.amazonaws.com/${StageName}

在我的例子中，

StageName

是

Prod

，我作为

Prod