在Java中通过IAM权限访问AWS API Gateway：签名V4认证教程

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpResponse;
import java.net.http.HttpRequest;

public class ApiGatewayClientExample {

  public static void main(String[] args) throws Exception {
    HttpClient client = HttpClient.newHttpClient();

    // 构建一个未签名的请求
    HttpRequest request = HttpRequest.newBuilder()
      .uri(URI.create("https://abc123.execute-api.us-east-1.amazonaws.com/prod/controlplane/model/a1"))
      .header("accept", "application/json")
      .GET() // 明确指定GET方法
      .build();

    HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());

    System.out.println("Response Status: " + response.statusCode());
    System.out.println("Response Body: " + response.body());
  }
}

<dependencies>
    <dependency>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>auth</artifactId>
        <version>2.20.100</version> <!-- 使用最新稳定版本 -->
    </dependency>
    <dependency>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>regions</artifactId>
        <version>2.20.100</version> <!-- 使用最新稳定版本 -->
    </dependency>
    <dependency>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>http-client-spi</artifactId>
        <version>2.20.100</version>
    </dependency>
</dependencies>

import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
import software.amazon.awssdk.core.signer.Signer;
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.http.SdkHttpFullRequest;
import software.amazon.awssdk.http.SdkHttpMethod;
import software.amazon.awssdk.http.SdkHttpRequest;
import software.amazon.awssdk.core.signer.AwsV4Signer;
import software.amazon.awssdk.utils.BinaryUtils;

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Instant;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.stream.Collectors;

public class SignedApiGatewayClient {

    public static void main(String[] args) throws Exception {
        // 1. 配置AWS凭证
        // 建议从环境变量或AWS凭证链中获取，此处为示例硬编码
        String accessKey = System.getenv("AWS_ACCESS_KEY_ID");
        String secretKey = System.getenv("AWS_SECRET_ACCESS_KEY");
        if (accessKey == null || secretKey == null) {
            System.err.println("Error: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables must be set.");
            return;
        }

        AwsBasicCredentials credentials = AwsBasicCredentials.create(accessKey, secretKey);
        StaticCredentialsProvider credentialsProvider = StaticCredentialsProvider.create(credentials);

        // 2. 定义API Gateway端点和区域
        String endpoint = "https://abc123.execute-api.us-east-1.amazonaws.com/prod/controlplane/model/a1";
        Region region = Region.US_EAST_1;
        String serviceName = "execute-api"; // API Gateway的签名服务名称

        // 3. 构建原始的 java.net.http.HttpRequest
        URI uri = URI.create(endpoint);
        HttpRequest.Builder requestBuilder = HttpRequest.newBuilder()
                .uri(uri)
                .header("accept", "application/json")
                .GET(); // 或者 .POST(HttpRequest.BodyPublishers.ofString("{\"key\":\"value\"}")) 等

        HttpRequest originalHttpRequest = requestBuilder.build();

        // 4. 将 java.net.http.HttpRequest 转换为 SdkHttpRequest
        // SdkHttpRequest 是 AWS SDK 内部用于签名的抽象
        SdkHttpRequest.Builder sdkRequestBuilder = SdkHttpRequest.builder()
                .uri(uri)
                .method(SdkHttpMethod.fromValue(originalHttpRequest.method()));

        // 复制原始请求的头部
        originalHttpRequest.headers().map().forEach((name, values) -> {
            // 排除Host头，因为SigV4会重新计算并添加
            if (!name.equalsIgnoreCase("Host")) {
                sdkRequestBuilder.putHeader(name, values);
            }
        });

        // 如果有请求体，也需要处理
        // 注意：java.net.http.HttpRequest 的 BodyPublisher 无法直接转换为 SdkHttpRequest 的内容
        // 这里假设是GET请求或POST请求体已提前获取并转换为字节数组
        // 对于POST/PUT等有请求体的操作，需要额外处理请求体并计算其SHA256哈希
        // 简化示例，假设为GET请求或请求体为空
        // 如果有请求体，需要将其内容作为 input.contentStream() 或 input.content() 传入
        // 并在 sdkRequestBuilder 中设置 .contentHash(BinaryUtils.toFipsCompliantSha256(requestBodyBytes))
        // 例如：
        // byte[] requestBody = "{\"key\":\"value\"}".getBytes(StandardCharsets.UTF_8);
        // sdkRequestBuilder.contentHash(BinaryUtils.toFipsCompliantSha256(requestBody));
        // sdkRequestBuilder.content(AsyncRequestBody.fromBytes(requestBody)); // 如果是同步请求，直接用BytesSource

        SdkHttpFullRequest sdkHttpRequest = (SdkHttpFullRequest) sdkRequestBuilder.build();

        // 5. 使用 AwsV4Signer 签署请求
        Signer signer = AwsV4Signer.create();
        SdkHttpFullRequest signedSdkRequest = (SdkHttpFullRequest) signer.sign(sdkHttpRequest, credentialsProvider.resolveCredentials(), region, serviceName);

        // 6. 将签名的 SdkHttpRequest 的头部信息复制回 java.net.http.HttpRequest.Builder
        HttpRequest.Builder signedJavaHttpRequestBuilder = HttpRequest.newBuilder()
                .uri(signedSdkRequest.uri())
                .method(signedSdkRequest.method().name());

        signedSdkRequest.headers().forEach((name, values) -> {
            for (String value : values) {
                signedJavaHttpRequestBuilder.header(name, value);
            }
        });

        // 如果原始请求有请求体，这里也需要复制
        // 对于POST/PUT等，需要确保请求体内容在签名前后一致
        // 简单的GET请求则无需处理请求体
        // signedJavaHttpRequestBuilder.POST(HttpRequest.BodyPublishers.ofByteArray(requestBody));

        HttpRequest signedHttpRequest = signedJavaHttpRequestBuilder.build();

        // 7. 使用 java.net.http.HttpClient 发送签名的请求
        HttpClient client = HttpClient.newHttpClient();
        HttpResponse<String> response = client.send(signedHttpRequest, HttpResponse.BodyHandlers.ofString());

        System.out.println("Signed Request Response Status: " + response.statusCode());
        System.out.println("Signed Request Response Body: " + response.body());
    }
}