Lambda function not authorized to perform apigateway:GET

Question

I'm trying to invoke a function with AWS-SDK from Gateway api but I receive the error below.

The execution role has a policy with execute-api:* as action and resoure is '*'.

And the code is:

const restApi = await new Promise((resolve, reject) => {
        apiGateway.getRestApi({restApiId: myRestApi}, function(err, data) {

The error:

2020-06-06T08:58:47.741Z    d3e08e04-095c-41ec-bbe6-69344d53854c    INFO    getRestApi err AccessDeniedException: User: arn:aws:sts::123412341234:assumed-role/mydev-LambdaExecutionRole/mydev-api-FooFunctionsStack-AddFooFunction-123ASDF is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:eu-west-1::/restapis/xxx111yy
    at Object.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/json.js:51:27)
    at Request.extractError (/var/runtime/node_modules/aws-sdk/lib/protocol/rest_json.js:55:8)
    at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
    at Request.emit (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:78:10)

The network settings should be fine, lambda is within VPC but it has public subnet to connect services outside from it. Previously it didn't and the apiGateway.getRestApi was timed out.

Role policy:

LambdaExecutionRole: 
    Type: AWS::IAM::Role
    Properties: 
      RoleName: 'MyRole'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement: 
          - Effect: Allow
            Principal: 
              Service: 
                - lambda.amazonaws.com
            Action: 
              - sts:AssumeRole
      Policies: 
        - PolicyName: lambda-execution-policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action: 
                  - secretsmanager:GetSecretValue
                  - rds:*
                  - rds-data:* 
                  - ses:SendEmail
                  - ses:SendRawEmail 
                  - ec2:DescribeNetworkInterfaces
                  - ec2:CreateNetworkInterface
                  - ec2:DeleteNetworkInterface
                  - s3:*
                  - execute-api:*
                Resource: '*'

user_248823 · Answer

lambda is within VPC but it has public subnet to connect services outside from it

Unfortunately the error is not about public access to the API gateway, which is required for getting information about the api.

Instead, the error is about your lambda's execution role mydev-LambdaExecutionRole not having permissions to execute GET method on the xxx111yy resource.

Your permissions execute-api:* are for invoking the api. Your lambda function should have permissions for apigateway:* which is used to get information about api. For example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "apigateway:GET",
            "Resource": "*"
        }
    ]
}

There are two ways to rectify the issue:

add the lambda's execution role ARN into api getaway resource policy with the required permissions
or add required permissions to your lambda's execution role itself.

Lambda function not authorized to perform apigateway:GET

1 Answers