Nginx reverse proxy for AWS APIGateway

Question

My use case is that I want to route the following request http://localhost/STAGE/RESOURCE/123 to https://MyGatewayID.execute-api.us-west-2.amazonaws.com/STAGE/RESOURCE/123

where 123 is a path param

I am trying to setup reverse proxy for my AWS API Gateway using Nginx but am getting the following errors when am testing via postman

The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'GET\n/alpha/data/ ...

I have configured AWS authorization headers with access key and secret to hit API Gateway successfully with postman when am using the API Gateway url but when am replacing it with localhost, its giving the above error

This is working in postman https://MyGatewayID.execute-api.us-west-2.amazonaws.com/STAGE/RESOURCE/123

This is not working in postman https://localhost/STAGE/RESOURCE/123

Here is my nginx configuration

   server {

    listen       80 default_server;
    listen       [::]:80 default_server;
    server_name  localhost;
    root         /usr/share/nginx/html;

    # Load configuration files for the default server block.
    include /etc/nginx/default.d/*.conf;

    location / {
            proxy_set_header Host $proxy_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass https://MyGatewayID.execute-api.us-west-2.amazonaws.com;
            proxy_ssl_server_name on;
            proxy_ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
            proxy_buffering off;
    }

Jonny Jonny · Accepted Answer · 2019-12-06T15:36:47

The signatures do not match because the hostname is used to generate the signature. Postman is generating a signature with "localhost" and API Gateway is expecting "MyGatewayID.execute-api.us-west-2.amazonaws.com".

For full details on the components of the signature see Authenticating Requests (AWS Signature Version 4).

As a workaround add your gateway hostname as a Host header to your request. Postman will use that instead when generating the signature.

I've hit the same issue. Except I don't want my users to have to know the hostname of my private gateway.

Nginx reverse proxy for AWS APIGateway

1 Answers