2

I changed the Authorization Type for API to AWS_IAM, then I created an user with the following policy:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "execute-api:Invoke" ], "Resource": [ "arn:aws:execute-api:us-east-1:account_id:api-id/stage/GET/*" ] } ] }

And tried to access this API through postman, and it worked. But when I'm giving this user's access_key_id and secret_access_key to an EC2 instance through aws configure and then trying to access the API (curl URL), its giving me Missing Authentication token.

Any help is appreciated. Thank You.

Sagar Ajmire
  • 333
  • 3
  • 13
  • 1
    First of all, you should use *roles* to assign IAM permissions to AWS resources – mewa Mar 01 '18 at 14:06
  • How do you access it through Postman? For this policy to work, you must be supplying credentials somewhere. Doing a `curl` won't supply credentials unless you authenticate as your user somehow beforehand. – timothyclifford Mar 01 '18 at 14:13

1 Answers1

2

When your API Gateway is using AWS_IAM authentication, you must send an AWS SigV4 authenticated request to your API endpoint (just like the AWS SDKs would to the AWS APIs).

Postman has a built-in SigV4 authentication mode that makes it easy to test. However, curl does not. curl is not part of the AWS CLI, so it's not going to care what you do with aws configure. This is why it's failing with curl. Executing the command on your EC2 instance won't magically make authentication work.

In order to use curl to make a request, you will need to compute and calculate your own SigV4 signature parameters & headers to go along with the request.

I just found (what looks to be) a good curl-alternative to handle this for you:

https://github.com/okigan/awscurl

It includes an API gateway example.

Matt Houser
  • 33,983
  • 6
  • 70
  • 88