Adding query strings on AWS API GATEWAY GET call results in 403 error

Question

I am attempting to call an api gateway endpoint that sends a GET request to a lambda that accesses an underlying S3 bucket via Athena.

The existing call targets a url similar to:

https://url.api.eu-west-2.amazomaws.com/prod/api_path

This is successful and returns a 200 response from a node.js front-end However adding the queryString param like so:

https://url.api.eu-west-2.amazomaws.com/prod/api_path?param_1=1

Results in a 403 error. The IAM role assumed by the front-end has been given wildcard access to all methods permitted by this method ARN.

The param call works when testing via API Gateway test events so I believe it is permission based. The role assumed by the front-end user is:

user_role.add_to_principal_policy(
            iam.PolicyStatement(
                effect=iam.Effect.ALLOW,
                resources=[
                    get_method.method_arn,
                ],
                actions=["execute-api:Invoke"],
            )
        )

user_role.add_to_principal_policy(
            iam.PolicyStatement(
                effect=iam.Effect.ALLOW,
                resources=[
                    "arn:aws:s3:::" + bucket.bucket_name + "/*",
                ],
                actions=[
                    "s3:PutObject",
                    "s3:GetObjectAcl",
                    "s3:PutObjectAcl",
                    "s3:AbortMultipartUpload",
                    "s3:ListBucketMultipartUploads",
                    "s3:ListMultipartUploadParts",
                ],
            )
        )

        # Add the standard permissions required by an authenticated cognito user
        user_role.add_to_principal_policy(
            iam.PolicyStatement(
                effect=iam.Effect.ALLOW,
                resources=["*"],
                actions=[
                    "mobileanalytics:PutEvents",
                    "cognito-sync:*",
                    "cognito-identity:*",
                ],
            )
        )

I have attempted to update the cloudfront deployment to allow query strings but this was not successful. I have tried adding query strings manually as an option in API Gateway configuration but without success.

I am at a loss as to why addition of query strings has resulted in a forbidden error.

The specific error given is

{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.

Michael Cropper · Answer

No-one is going to be able to answer this question for you as this is completely specific to your implementation. There are a million + 1 configurations options with AWS permissions that only you would know.

403 = Forbidden

You've clearly passed through the Authentication process (i.e. you're allowed entry through the front door as you haven't received a 401 Unauthorised error).

So as part of your architecture a > b > c > d > e, you need to debug step by step which part of this is throwing the 403 error. Do this methodically.

Microservices are a pain in the arse to debug. Take a look at other handy AWS tools such as AWS X-Ray which can aid in making this less painful.

Adding query strings on AWS API GATEWAY GET call results in 403 error

1 Answers