How to construct AWS CloudFormation integration URI for AWS ApiGateway integration with S3, SQS, SNS, DynamoDB and other services?

Question

Is there some place with samples on how to make a bunch of actions through ApiGateway integration? Looking how to upload object to S3, push item to SQS & SNS queues, make DynamoDB call and many other things, trying to find documentation on how to construct those paths.

I'm using CloudFormation template, which uses integration URI to setup this AWS ApiGateway integration with AWS services.

Can't find documentation talking how to make these URI paths for all kind of services.

Not sure about API gateway integrations but have you looked into a lambda as integration, with this your possibilities are endless. — Lucasz, Oct 02 '21 at 09:55
I prefer using !sub instead of !join as it is much more powerful and more readable. — Lucasz, Oct 02 '21 at 10:07
@Lucasz i want to avoid lambda calls. I don't like to manage concurrency, extra delays, tracking if spike will be handled by warming up suddenly, extra $ and so on. Lambda is often not needed. `!Sub` or `!Join` i use both of those but still question is same, how to make those paths — Lukas Liesis, Oct 02 '21 at 10:20
I agree with that. Just want to make sure you know the possibility. With sub it would be: !Sub "/${ProfilePictureBucketArn}/images/{objectname}" — Lucasz, Oct 02 '21 at 10:24

score 1 · Answer 1 · answered Oct 02 '21 at 10:03

When setting up the integration request with another AWS service action, the integration request URI is also an ARN.

For example, for the integration with the GetBucket action of Amazon S3, the integration request URI is an ARN of the following format:

arn:aws:apigateway:api-region:s3:path

See more: https://docs.aws.amazon.com/apigateway/latest/developerguide/integration-request-basic-setup.html

Dynamodb: A bit more complicated then S3: https://aws.amazon.com/blogs/compute/using-amazon-api-gateway-as-a-proxy-for-dynamodb/

SNS: https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-proxy-integrate-service/

For SQS I have found cloudformation setup:

PostMethod:
    Type: "AWS::ApiGateway::Method"
    Properties:
      AuthorizationType: "NONE"
      ApiKeyRequired: "true"
      HttpMethod: "POST"
      ResourceId: !Ref "SomeResource"
      RestApiId: !Ref "RestApi"
      MethodResponses:
      - StatusCode: 200
      Integration:
        Credentials: !GetAtt "RestApiRole.Arn"
        IntegrationHttpMethod: "POST"
        IntegrationResponses:
        - StatusCode: 200
        Type: "AWS"
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:sqs:action/SendMessage"
        RequestParameters:
          integration.request.querystring.QueueUrl: !Sub "'${SomeQueue}'"
          integration.request.querystring.MessageBody: "method.request.body"

and here the code for RestApiRole:

RestApiRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Action:
          - "sts:AssumeRole"
          Principal:
            Service:
            - "apigateway.amazonaws.com"
          Effect: "Allow"
      Policies:
      - PolicyName: "InvokeLambda"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Action:
            - "lambda:InvokeFunction"
            Resource: !GetAtt "LambdaFunction.Arn"
            Effect: "Allow"

Lukas Liesis · Accepted Answer · 2021-10-02T16:51:40.400

From Uri property documentation:

If you specify AWS for the Type property, specify an AWS service that follows this form: arn:aws:apigateway:region:subdomain.service|service:path|action/service_api. For example, a Lambda function URI follows this form: arn:aws:apigateway:region:lambda:path/path. The path is usually in the form /2015-03-31/functions/LambdaFunctionARN/invocations. For more information, see the uri property of the Integration resource in the Amazon API Gateway REST API Reference.

More descriptions and samples from another AWS documentation:

From these documentation samples & descriptions it seems there are 2 type of APIs - action based and path based.

Using Action based API

I think most, if not all support this. While those actions are available in IAM settings and all API documentations, while all AWS services are web services, aka they have API interfaces and those interfaces use Actions. Correct me if that's wrong for some service, but I think by following this structure should be possible to make any call to any service which has integration with API Gateway service.

Sometimes need to use path API

Was trying to upload file to S3 with PutObject and it was giving error:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>MethodNotAllowed</Code>
    <Message>The specified method is not allowed against this resource.</Message>
    <Method>PUT</Method>
    <ResourceType>SERVICE</ResourceType>
    <RequestId>....</RequestId>
    <HostId>....=</HostId>
</Error>

Replaced with path API format and it worked out. So the learning here is I will continue to try using action APIs first and if can't for that specific action - switch to path API while I feel Action API is more declarative.

Sample structure Action API:

arn:aws:apigateway:us-east-1:SERVICE_NAME:action/ACTION_NAME&Var1=Value1&Var2=Value2

Sample call to S3 service. Action name - GetObject. Documentation for this API Actions says there are 2 required properties - Bucket (bucket name) and Key. So full sample URI:

arn:aws:apigateway:us-east-1:s3:action/GetObject&Bucket=myDemoBucket1&Key=some/path/to/file

Same thing with path API:

arn:aws:apigateway:us-east-1:s3:path/myDemoBucket1/some/path/to/file

I found one way to get samples. Use console UI, make the endpoint, deploy to some stage and go to stage, select Export tab, and export as Swagger + API Gateway Extensions in Yaml format. While i use Yaml with cloudformation. Inside that Yaml there are all you need. If there are no "Stages", go to "Resources" and from dropdown select deploy and create Stage inside dialog.

Here are some different samples I was able to find for main services:

Invoke Lambda docs:

arn:aws:apigateway:api-region:lambda:path//2015-03-31/functions/arn:aws:lambda:lambda-region:account-id:function:lambda-function-name/invocations

The path part seems to map to API action from API docs:

DynamoDB blog post

You need to use HTTP method by API Action documentation + Api Action name + IntegrationRequest template to call DynamoDB.

Sample URI for Query action:

arn:aws:apigateway:us-east-1:dynamodb:action/Query

SNS blog post

Sample URI: arn:aws:apigateway:region:sns:action/Publish With region: arn:aws:apigateway:us-east-1:sns:action/Publish

You need to pass in TopicArn and Message and other parameters through URL Query String Parameters. There is good thread on the topic: https://stackoverflow.com/a/64268791/1737158

https://docs.aws.amazon.com/sns/latest/api/API_Publish.html#API_Publish_Examples

You can use a tool like https://github.com/iann0036/AWSConsoleRecorder to record what you are doing in console and this will create a cloudformation, CDK or CLI commands for what you did in the console. It doesn't support every resource but might be nice to try — Lucasz, Oct 02 '21 at 11:09
@Lucasz just tried it, created a bucket, changed some options on that bucket and nothing recorded : ( will try to play with it more later — Lukas Liesis, Oct 02 '21 at 11:22
I checked the supported resources, S3 Ddoesnt seem to be covered. But the API integrations is supported! https://github.com/iann0036/AWSConsoleRecorderGenerator/blob/master/coverage.md — Lucasz, Oct 02 '21 at 11:25

How to construct AWS CloudFormation integration URI for AWS ApiGateway integration with S3, SQS, SNS, DynamoDB and other services?

2 Answers2