AppSync request from API Gateway: Valid authorization header not provided

Viewed 16

I have an AWS architecture like this:

An API Gateway with many endpoints. One of them is "/graphql" The "/graphql" API Gateway endpoint points to a "/graphql" AppSync endpoint

My API Gateway uses COGNITO_USER_POOL to authentificate users. When an user makes a request to "/graphql" endpoint of API Gateway, he must to add id_token to "Authorization" header on the request. It works well.

My integration method on API Gateway gets the "Authorization" header and puts it on AppSync request using this HTTP Headers mapping:

Authorization = method.request.header.Authorization

It seems to work correctly also. Nevermind, I got this AppSync error when requesting the API Gateway endpoint:

{
    "errors": [
        {
            "errorType": "UnauthorizedException",
            "message": "Valid authorization header not provided."
        }
    ]
}

It doesn't seems to be a token problem, because it works correctly when I request the AppSync endpoint directly (with the same Authorization header).

I observed that API Gateway adds some headers on the AppSync request, to generate a Signature. So my question is: Is there any way to do a request on AppSync from API Gateway without pass the Signature, only the id_token that user got from Cognito User Pool? I'd like to ignore IAM and use only the token (as I do when the request is done directly on AppSync from Postman).

Many thanks!

0 Answers
Related