有很多方法可以做到这一点。例如，如果您使用SAM，请参见下面的代码片段（如果您选择这条路线，则可以使用CDK执行相同的操作）。
在这里，您可以将passthroughBehavior指定为never，以阻止任何无效输入。
此外，您可以指定x-amazon-apigateway-request-validators来验证所有请求头和请求体。
请查看有关如何执行基本请求验证here的文档

MyServerlessApi:
    Type: AWS::Serverless::Api
    Properties:
      # Use DefinitionBody for swagger file so that we can use CloudFormation intrinsic functions within the swagger file
      DefinitionBody:
        "Fn::Transform":
          Name: "AWS::Include"
          Parameters:
            Location: "../../swagger/api.yaml"
      StageName: v1
      EndpointConfiguration: REGIONAL
      TracingEnabled: true # Enable AWS X-Ray to help debug API requests
      MethodSettings:
        - ResourcePath: "/*"
          HttpMethod: "*"
          # Disable data trace in production to avoid logging customer sensitive information from requests and responses
          DataTraceEnabled: true
          LoggingLevel: INFO
          MetricsEnabled: true
          ThrottlingRateLimit: 300
          ThrottlingBurstLimit: 350
      AccessLogSetting:
        DestinationArn: !Sub "arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:slsapi1grp"
        Format: '$context.identity.sourceIp $context.authorizer.claims.sub [$context.requestTime] "$context.httpMethod $context.resourcePath $context.protocol" $context.status $context.requestId $context.awsEndpointRequestId $context.xrayTraceId $context.responseLatency $context.integrationLatency "$context.error.message"'
      OpenApiVersion: "3.0.0"
      Cors:
        AllowOrigin: "'*'"
        AllowHeaders: "'authorization, content-type'"

API swagger模式的片段

openapi: 3.0.0

info:
  title:
    Fn::Sub: validate-request
  description: Validation Snippet
  contact:
    email: email@local
  version: 1.0.0

# Enable request validator. 
# See doc: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-validation-sample-api-swagger.html
x-amazon-apigateway-request-validators:
  "All":
    validateRequestBody: true
    validateRequestParameters: true
  "ValidateHeaderOnly":
    validateRequestBody: false
    validateRequestParameters: true
  "ValidateBodyOnly":
    validateRequestBody: true
    validateRequestParameters: false
x-amazon-apigateway-request-validator: "All" # Validate Header and Body

x-amazon-apigateway-gateway-responses:
  # Provide more detailed error message for bad request body errors. 
  # See doc: https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-swagger-extensions-gateway-responses.html
  BAD_REQUEST_BODY:
    responseTemplates:
      application/json: '{"errorCode": "BadRequestBody", "message": "$context.error.validationErrorString"}'
    responseParameters:
      gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
  DEFAULT_4XX:
    responseParameters:
      gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
  DEFAULT_5XX:
    responseParameters:
      gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
paths:
  /api:
    post:
      operationId: Create
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateInput"
        required: true
      responses:
        "201":
          description: "Create"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Details"
        "400":
          description: "Bad Request Exception"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/BadRequestException"
        "401":
          description: "Unauthorized Exception"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UnauthorizedException"
        "409":
          description: "Conflict Exception"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConflictException"
        "429":
          description: "Too Many Requests Exception"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/TooManyRequestsException"
        "500":
          description: "Internal Server Error"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/InternalServerErrorException"
      x-amazon-apigateway-integration:
        uri:
          Fn::Sub: arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyServerlessApi.Arn}:live/invocations
        httpMethod: POST
        type: aws_proxy
        passthroughBehavior: never # do not send incorrectly formatted input
      security:
        - tokenAuthorizer: []