AWS API Gateway change access denied response message from resource policy

You can make use of Gateway Responses in API Gateway to modify the HTTP status code and response that goes back to a client.

By default, for the scenario you have described, the response is the big message you see and status code is 403. To change this -

1. Go to "Gateway Responses" on the left column for your API.
2. Select "Access Denied" and click on "Edit" on top right.
3. Click on "application/json" under "Response templates".
4. Modify the message there as {"message":"Your custom message"} in the "Response body template" section.
5. Deploy the API and wait for a minute for changes to propagate.

If you see the image below, I have changed the status code to 401 and message to "Unauthorized".

Unsure if this has changed but my API is restricted to sources from known IPs through the use of the resource policy - this throws a "DEFAULT_4XX" response so it is this one that needs to be updated in the Gateway Responses (and then the API deployed to propagate the change) rather than the "Access Denied" response.

The available fields for the template are listed below, though as this is on the default 4XX response you may want to consider generic responses...

{
    "context.accountId": "$context.accountId",
    "context.apiId": "$context.apiId",
    "context.authorizer.claims.property": "$context.authorizer.claims.property",
    "context.authorizer.principalId": "$context.authorizer.principalId",
    "context.authorizer.property": "$context.authorizer.property",
    "context.awsEndpointRequestId": "$context.awsEndpointRequestId",
    "context.domainName": "$context.domainName",
    "context.domainPrefix": "$context.domainPrefix",
    "context.error.message": "$context.error.message",
    "context.error.messageString": "$context.error.messageString",
    "context.error.responseType": "$context.error.responseType",
    "context.error.validationErrorString": "$context.error.validationErrorString",
    "context.extendedRequestId": "$context.extendedRequestId",
    "context.httpMethod": "$context.httpMethod",
    "context.identity.accountId": "$context.identity.accountId",
    "context.identity.apiKey": "$context.identity.apiKey",
    "context.identity.apiKeyId": "$context.identity.apiKeyId",
    "context.identity.caller": "$context.identity.caller",
    "context.identity.cognitoAuthenticationProvider": "$context.identity.cognitoAuthenticationProvider",
    "context.identity.cognitoAuthenticationType": "$context.identity.cognitoAuthenticationType",
    "context.identity.cognitoIdentityId": "$context.identity.cognitoIdentityId",
    "context.identity.cognitoIdentityPoolId": "$context.identity.cognitoIdentityPoolId",
    "context.identity.principalOrgId": "$context.identity.principalOrgId",
    "context.identity.sourceIp": "$context.identity.sourceIp",
    "context.identity.clientCert.clientCertPem": "$context.identity.clientCert.clientCertPem",
    "context.identity.clientCert.subjectDN": "$context.identity.clientCert.subjectDN",
    "context.identity.clientCert.issuerDN": "$context.identity.clientCert.issuerDN",
    "context.identity.clientCert.serialNumber": "$context.identity.clientCert.serialNumber",
    "context.identity.clientCert.validity.notBefore": "$context.identity.clientCert.validity.notBefore",
    "context.identity.clientCert.validity.notAfter": "$context.identity.clientCert.validity.notAfter",
    "context.identity.user": "$context.identity.user",
    "context.identity.userAgent": "$context.identity.userAgent",
    "context.identity.userArn": "$context.identity.userArn",
    "context.path": "$context.path",
    "context.protocol": "$context.protocol",
    "context.requestId": "$context.requestId",
    "context.requestOverride.header.header_name": "$context.requestOverride.header.header_name",
    "context.requestOverride.path.path_name": "$context.requestOverride.path.path_name",
    "context.requestOverride.querystring.querystring_name": "$context.requestOverride.querystring.querystring_name",
    "context.responseOverride.header.header_name": "$context.responseOverride.header.header_name",
    "context.responseOverride.status": "$context.responseOverride.status",
    "context.requestTime": "$context.requestTime",
    "context.requestTimeEpoch": "$context.requestTimeEpoch",
    "context.resourceId": "$context.resourceId",
    "context.resourcePath": "$context.resourcePath",
    "context.stage": "$context.stage",
    "context.wafResponseCode": "$context.wafResponseCode",
    "context.webaclArn": "$context.webaclArn"
}