AWS Cognito and API Gateway Authentication

1
votes

I have a GET method setup under API gateway (Auth: AWS_IAM) and have a Cognito pool with developer identity. I have a lambda behind get method.

When I call Cognito I get the temporary credentials and I assume a role. My assumed role has the proper permission to execute and access everything on API gateway.

       ...
       {
            "Effect": "Allow",
            "Action": [
                "execute-api:Invoke"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "apigateway:GET"
            ],
            "Resource": [
                "*"
            ]
        }
        ...

When I call the API gateway with this setup I get a 500, Internal Server Error.

If I remove the above API Gateway permissions from the policy then I get 403 error forbidden (User: arn:aws:sts::xxxxx:assumed-role/Cogn_Auth_Role/xxx is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-1:xxxx:xxx/xxx/GET/events

If I go and attached the AdminAccess to this role then everything works fine. what is the deal here? Am I missing something?

3
amazon-web-servicesaws-lambdaaws-api-gatewayamazon-cognitoamazon-iam
Hi johnny did you get any success? - Krishna
yes, see the second answer below. What I needed was lambada invocation. Try AWS policy simulator and see what permission you missing if you experience something like this. - johnny
Thank you so much @johnny. Let me try with lambda invocation. But I m confuse we can't use API Gateway with cognito and without lambda? - Krishna
I think it depends how you architecture but in general you should be able to use them together. - johnny
where is this file policy located? - Alberto Sinigaglia

3 Answers

6
votes

So after modifying the policy of cognito role like this, it start working fine.

  {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "lambda:InvokeFunction"
                ],
                "Resource": [
                    "*"
                ]
            },
            {
                "Effect": "Allow",
                "Action": [
                    "execute-api:Invoke"
                ],
                "Resource": [
                    "*"
                ]
            }
        ]
    }

the important piece that make it work: 

  {
        "Effect": "Allow",
        "Action": [
            "lambda:InvokeFunction"
        ],
        "Resource": [
            "*"
        ]
    }

still not sure why I should have invoke permission for all lambdas.

2
votes

If you are just trying to invoke your API Gateway API with Cognito credentials, then you may not need "apigateway:GET" in your policy. Since that is used to manage your API, e.g. to get information about your API resources.

If you are just trying to create a role so that your API can be invoked, you could try removing "apigateway:GET" from your policy and see if it works. More information.

0
votes

This could also be due to the case that you have a Condition in your API Gateway resource policy which only allows access by clients that satisfy the requirement. If you were accessing the API Gateway for testing with Postman, then you would get the Unauthorized error. For example,

"Condition": {
        "StringLike": {
            "aws:Referer": [
                "https://example.com/*",
                "example.com/*"
            ]
          }
         }