DescribeEndpoint from inside a lambda

Question

I am setting up a CF stack using the CDK.  I am planning on having API gateway host a Lambda function to return the IoT Core mqtt endpoint for my remote IoT clients.

Is there a way within the SDK to call [DescribeEndpoint](https://docs.aws.amazon.com/iot/latest/apireference/API_DescribeEndpoint.html) from inside the lambda, or do I have to fetch() it from the URL?  I'm not quite sure how I would go about calling that, since it needs account permissions.

Inside my Lambda, I'm trying this:

```
export async function getMqttEndpoint(request: APIGatewayProxyEventV2): Promise {
    const client = new IoTClient({});

const command = new DescribeEndpointCommand({
        endpointType: "iot:Data"
    });

return client.send(command)
        .then((response) => {
            return {
                body: response.endpointAddress
            }
        });
}
```

Accepted Answer

ok I figured it out.  I just didn't have the right permissions granted to the lambda.

In case anybody ever needs this in the future, here's how I did this in CDK:

```
        const extraPolicyStatements = new iam.Policy(this, 'describe-endpoint-policy', {
            statements: [
                new iam.PolicyStatement({
                    actions: ["iot:DescribeEndpoint"],
                    resources: ["*"]
                }),
                new iam.PolicyStatement({
                    actions: ["logs:CreateLogGroup"],
                    resources: [`arn:aws:logs:${this.env.region}:${this.env.account}:*`]
                }),
                new iam.PolicyStatement({
                    actions: [
                        "logs:CreateLogStream",
                        "logs:PutLogEvents"
                    ],
                    resources: [`arn:aws:logs:${this.env.region}:${this.env.account}:log-group:/aws/lambda/*:*`]
                })
            ]
        });

const role = new iam.Role(this,
            "abcdEndpointExecRole", {
                roleName: "abcdEndpointExecRole",
                assumedBy: new iam.ServicePrincipal('lambda.amazonaws.com'),
                inlinePolicies: {
                    "describe": extraPolicyStatements.document
                }
            });
```

then gave that to the Lambda as its role.  Not sure that's the best way or not but it is readable and it wroks.

DescribeEndpoint from inside a lambda

Relevanter Inhalt