-1

I'm deploying a serverless application using the AWS SAM Cli and template, but the API Gateway resource is returning a 403 ForbiddenException error when trying to curl / postman it. Tried looking online, but haven't been able to find any answers that solved my issue and wondering if anyone here has experienced this before.

template.yaml:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31


Globals:
  Function:
    Runtime: nodejs10.x
    MemorySize: 256

  Api:
    Cors:
      AllowMethods: "'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT'"
      AllowHeaders: "'Content-Type,X-Amz-Date,X-Amz-Security-Token,Authorization,X-Api-Key,X-Requested-With,Accept,Access-Control-Allow-Methods,Access-Control-Allow-Origin,Access-Control-Allow-Headers'"
      AllowOrigin: "'*'"

Parameters:
  ApiKey:
    Type: String
    Default: none

Conditions:
  CreateApiKey: !Not [!Equals [!Ref ApiKey, 'none']]

Resources:
  # DynamoDB table setup
  DyanmoDBStoryTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Stories
      AttributeDefinitions:
        - AttributeName: short_id
          AttributeType: S
      KeySchema:
        - AttributeName: short_id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 0
        WriteCapacityUnits: 0
      BillingMode: PAY_PER_REQUEST

  # Log group
  DynamoSaveStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoSaveStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoSaveStoryLambda}'
  DynamoGetStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoGetStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoGetStoryLambda}'
  DynamoUpdateStoryLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn: [DynamoUpdateStoryLambda]
    Properties:
      RetentionInDays: 30
      LogGroupName: !Sub '/aws/lambda/${DynamoUpdateStoryLambda}'

  # Lambda Fn
  DynamoSaveStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/save-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story
            Method: post

  DynamoGetStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/get-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story/{shortId}
            Method: get

  DynamoUpdateStoryLambda:
    Type: AWS::Serverless::Function
    Properties:
      Policies:
        - AmazonDynamoDBFullAccess
      Handler: src/lambdas/update-story.handler
      Timeout: 10
      Events:
        SaveStory:
          Type: Api
          Properties:
            RestApiId: !Ref ApiGateway
            Path: /story/{shortId}
            Method: post

  # Custom API gateway setup API Keys & usage plans
  ApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        ApiKeyRequired: true

  UsagePlan:
    Type: AWS::ApiGateway::UsagePlan
    DependsOn: [ApiGatewayProdStage]
    Condition: CreateApiKey
    Properties:
      ApiStages:
        - ApiId: !Ref ApiGateway
          Stage: Prod

  DynamoLambdasApiKey:
    Type: AWS::ApiGateway::ApiKey
    DependsOn: [UsagePlan]
    Condition: CreateApiKey
    Properties:
      Value: !Ref ApiKey
      Enabled: true
      StageKeys:
        - RestApiId: !Ref ApiGateway
          StageName: Prod

  UsagePlanKey:
    Type: AWS::ApiGateway::UsagePlanKey
    Condition: CreateApiKey
    Properties:
      KeyId: !Ref DynamoLambdasApiKey
      KeyType: API_KEY
      UsagePlanId: !Ref UsagePlan

Outputs:
  StoryApi:
    Description: Serverless api url generated by AWS Cloudformation upon stack deployment
    Value: !Sub 'https://${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com/prod'
  ApiKey:
    Description: Api key to authorize access in API Gateway
    Value: !Ref ApiKey

SAM CLI Version: 0.47.0

Error:

Date →Sun, 26 Apr 2020 19:22:02 GMT
Content-Type →application/json
Content-Length →23
Connection →keep-alive
x-amzn-RequestId →01d6b9ec-dcf0-484c-be07-6b629437b305
x-amzn-ErrorType →ForbiddenException
x-amz-apigw-id →Lm_WOF9ZvHcF7nQ=

Testing it directly from the AWS Lambda console works correctly and cloudwatch logs are generated, but not when I curl/postman the request with the API url that is generated during deployment. I have tried the following:

  • Ensuring the x-api-key header is set correctly and verifying that the API Gateway in AWS console is set with the correct API Key
  • Configuring CORS in the API in globals of template. Confirming It creates the options endpoints in API Gateway console
  • Double checking the endpoints are correct

The error states that it is a cloudfront issue so I've confirmed that the S3 bucket has public access. There are no other cloudfront resources in the AWS console. I'm at a loss as to what is blocking the request.

Elbert Bae
  • 205
  • 3
  • 11

1 Answers1

1

Answer was simpler than I thought, but for anyone else that comes across this issue, the query parameter is case sensitive. The output url from the serverless application model deployment returns https://${serverlessAppId}.execute-api.${region}.amazonaws.com/${StageName}.

In my case, the StageName was Prod and I was making requests as prod

Elbert Bae
  • 205
  • 3
  • 11