对适用于 RabbitMQ 的亚马逊 MQ 使用 OAuth 2.0 身份验证和授权

使用 create-configuration AWS CLI 命令创建新配置，如以下示例所示。

aws mq create-configuration \
  --name "rabbitmq-oauth2-config" \
  --engine-type "RABBITMQ" \
  --engine-version "3.13"

此命令返回的响应与以下示例类似。

{
    "Arn": "arn:aws:mq:us-west-2:123456789012:configuration:c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca",
    "AuthenticationStrategy": "simple",
    "Created": "2025-07-17T16:03:01.759943+00:00",
    "Id": "c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca",
    "LatestRevision": {
    "Created": "2025-07-17T16:03:01.759000+00:00",
    "Description": "Auto-generated default for rabbitmq-oauth2-config on RabbitMQ 3.13",
    "Revision": 1
    },
    "Name": "rabbitmq-oauth2-config"
}

创建一个名为的配置文件rabbitmq.conf以使用 OAuth 2.0 作为身份验证和授权方法，如以下示例所示。

auth_backends.1 = oauth2

# FIXME: Update this value with the token signing key URL of your Amazon Cognito user pool.
# If you used the AWS CDK stack to deploy Amazon Cognito, this is one of the stack outputs.
auth_oauth2.jwks_url = ${RabbitMqOAuth2TestStack.JwksUri}
auth_oauth2.resource_server_id = rabbitmq
# Amazon Cognito does not include an audience field in access tokens
auth_oauth2.verify_aud = false 

# Amazon Cognito does not allow * in its custom scopes. Use aliases to translate between Amazon Cognito and RabbitMQ.
auth_oauth2.scope_prefix = rabbitmq/
auth_oauth2.scope_aliases.1.alias = rabbitmq/read:all
auth_oauth2.scope_aliases.1.scope = rabbitmq/read:*/*
auth_oauth2.scope_aliases.2.alias = rabbitmq/write:all
auth_oauth2.scope_aliases.2.scope = rabbitmq/write:*/*
auth_oauth2.scope_aliases.3.alias = rabbitmq/configure:all
auth_oauth2.scope_aliases.3.scope = rabbitmq/configure:*/*

# Allow OAuth 2.0 login for RabbitMQ management console
management.oauth_enabled = true
# FIXME: Update this value with the client ID of your public application client
management.oauth_client_id = ${RabbitMqOAuth2TestStack.ManagementConsoleAppClientId}
# FIXME: Update this value with the base JWKS URI (without /.well-known/jwks.json)
auth_oauth2.issuer = ${RabbitMqOAuth2TestStack.Issuer}
management.oauth_scopes = rabbitmq/tag:administrator

此配置使用作用域别名将 Amazon Cognito 中定义的范围映射到兼容 RabbitMQ 的作用域。

使用 update-configuration AWS CLI 命令更新配置，如以下示例所示。在此命令中，添加您在本过程步骤 1 的响应中收到的配置 ID。例如 c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca。

aws mq update-configuration \
  --configuration-id "<c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca>" \
  --data "$(cat rabbitmq.conf | base64 --wrap=0)"

此命令返回的响应与以下示例类似。

{
    "Arn": "arn:aws:mq:us-west-2:123456789012:configuration:c-b600ac8e-8183-4f74-a713-983e59f30e3d",
    "Created": "2025-07-17T16:57:04.520931+00:00",
    "Id": "c-b600ac8e-8183-4f74-a713-983e59f30e3d",
    "LatestRevision": {
        "Created": "2025-07-17T16:57:39.172000+00:00",
        "Revision": 2
    },
    "Name": "rabbitmq-oauth2-config",
    "Warnings": []
}

使用您在本过程的步骤 2 中创建的 OAuth 2.0 配置创建代理。为此，请使用 create-broker AWS CLI 命令，如以下示例所示。在此命令中，分别提供您在步骤 1 和步骤 2 的响应中获得的配置 ID 和修订号。例如，c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca 和 2。

aws mq create-broker \
 --broker-name "rabbitmq-oauth2-broker" \ 
 --engine-type "RABBITMQ" \
 --engine-version "3.13" \
 --host-instance-type "mq.m7g.large" \
 --deployment-mode "CLUSTER_MULTI_AZ" \
 --logs '{"General": true}' \
 --publicly-accessible \
 --configuration '{"Id": "<c-fa3390a5-7e01-4559-ae0c-eb15b38b22ca>","Revision": <2>}' \

此命令返回的响应与以下示例类似。

{
    "BrokerArn": "arn:aws:mq:us-west-2:123456789012:broker:rabbitmq-oauth2-broker:b-2a1b5133-a10c-49d2-879b-8c176c34cf73",
    "BrokerId": "b-2a1b5133-a10c-49d2-879b-8c176c34cf73"
}

使用 desc ribe-broker AWS CLI 命令验证代理的状态是否从CREATION_IN_PROGRESS转换为，如以下示例所示。RUNNING在此命令中，提供您在上一步的结果中获得的经纪人 ID。例如，b-2a1b5133-a10c-49d2-879b-8c176c34cf73。

aws mq describe-broker \
 --broker-id "<b-2a1b5133-a10c-49d2-879b-8c176c34cf73>"

此命令返回的响应与以下示例类似。以下响应是该describe-broker命令返回的完整输出的缩写版本。此响应显示代理状态和用于保护代理的身份验证策略。在这种情况下，config_managed身份验证策略表明代理使用 OAuth 2 种身份验证方法。

{
    "AuthenticationStrategy": "config_managed",
    ...,
    "BrokerState": "RUNNING",
    ...
}

要使用登录 RabbitMQ 管理控制台 OAuth2，需要将代理端点作为有效的回调 URL 添加到相应的 Amazon Cognito 应用程序客户端中。有关更多信息，请参阅 Amazon Cognito CDK 示例堆栈设置中的步骤 5。

使用以下perf-test.sh脚本验证 OAuth 2.0 身份验证和授权。

使用此 bash 脚本来测试与 Amazon MQ for RabbitMQ 代理的连接。此脚本从 Amazon Cognito 获取令牌并验证连接配置是否正确。如果配置成功，您将看到您的代理发布和使用消息。

如果您收到ACCESS_REFUSED错误，则可以使用代理 CloudWatch 日志对配置设置进行故障排除。您可以在 Amazon MQ 控制台中找到您的代理的 CloudWatch 日志组链接。

在此脚本中，您需要提供以下值：

#! /bin/bash
set -e

# Client information
## FIXME: Update this value with the client ID and secret of your confidential application client
CLIENT_ID=${RabbitMqOAuth2TestStack.AmqpAppClientId}
CLIENT_SECRET=${RabbitMqOAuth2TestStack.AmqpAppClientSecret}

# FIXME: Update this value with the domain of your Amazon Cognito user pool
RESPONSE=$(curl -X POST ${RabbitMqOAuth2TestStack.TokenEndpoint} \
                -H "Content-Type: application/x-www-form-urlencoded" \
                -d "grant_type=client_credentials&client_id=${CLIENT_ID}&client_secret=${CLIENT_SECRET}&scope=rabbitmq/configure:all rabbitmq/read:all rabbitmq/tag:administrator rabbitmq/write:all")


# Extract the access_token from the response.
# This token will be passed in the password field when connecting to the broker.
# Note that the username is left blank, the field is ignored by the plugin.
BROKER_PASSWORD=$(echo ${RESPONSE} | jq -r '.access_token')

# FIXME: Update this value with the endpoint of your broker. For example, b-89424106-7e0e-4abe-8e98-8de0dada7630.mq.us-east-1.on.aws.
BROKER_DNS=<broker_dns>
CONNECTION_STRING=amqps://:${BROKER_PASSWORD}@${BROKER_DNS}:5671 

# Produce/consume messages using the above connection string
QUEUES_COUNT=1
PRODUCERS_COUNT=1
CONSUMERS_COUNT=1
PRODUCER_RATE=1

docker run -it --rm --ulimit nofile=40960:40960 pivotalrabbitmq/perf-test:latest \
    --queue-pattern 'test-queue-%d' --queue-pattern-from 1 --queue-pattern-to $QUEUES_COUNT \
    --producers $PRODUCERS_COUNT --consumers $CONSUMERS_COUNT \
    --id "test${QUEUES_COUNT}q${PRODUCERS_COUNT}p${CONSUMERS_COUNT}c${PRODUCER_RATE}r" \
    --uri ${CONNECTION_STRING} \
    --flag persistent --rate $PRODUCER_RATE

要使用这两种身份验证方法，请创建您的代理配置，如以下示例所示。

auth_backends.1 = oauth2
auth_backends.2 = internal

# FIXME: Update this value with the token signing key URL of your Amazon Cognito user pool
auth_oauth2.jwks_url = ${RabbitMqOAuth2TestStack.JwksUri}
auth_oauth2.resource_server_id = rabbitmq
auth_oauth2.verify_aud = false

auth_oauth2.scope_prefix = rabbitmq/
auth_oauth2.scope_aliases.1.alias = rabbitmq/read:all
auth_oauth2.scope_aliases.1.scope = rabbitmq/read:*/*
auth_oauth2.scope_aliases.2.alias = rabbitmq/write:all
auth_oauth2.scope_aliases.2.scope = rabbitmq/write:*/*
auth_oauth2.scope_aliases.3.alias = rabbitmq/configure:all
auth_oauth2.scope_aliases.3.scope = rabbitmq/configure:*/*

此配置使用作用域别名将 Amazon Cognito 中定义的范围映射到兼容 RabbitMQ 的作用域。

创建一个同时使用两种身份验证方法的代理，如以下示例所示。

aws mq create-broker \
 --broker-name "rabbitmq-oauth2-broker-with-internal-user" \
 --engine-type "RABBITMQ" \
 --engine-version "3.13" \
 --host-instance-type "mq.m7g.large" \
 --deployment-mode "CLUSTER_MULTI_AZ" \
 --logs '{"General": true}' \
 --publicly-accessible \
 --configuration '{"Id": "<ConfigurationId>","Revision": <Revision>}' \
 --users '[{"Username":"<myUser>","Password":"<myPassword11>"}]'

验证代理状态以及设置身份验证方法的配置是否成功，如使用 Amazon Cognito 配置 OAuth 2.0 身份验证过程的步骤 5 和步骤 6 所述。