Lambda in VPC gets ForbiddenException on PostToConnection Despite Correct IAM & Networking

1. Use the Correct Endpoint URL for PostToConnection The most common cause of ForbiddenException here is that the Lambda is calling PostToConnection using the wrong endpoint. You need to use the WebSocket’s callback URL, not the default API Gateway endpoint or region endpoint.

Make sure your boto3 client is initialized like this:

import boto3

apigw_client = boto3.client(
    'apigatewaymanagementapi',
    endpoint_url="https://{api-id}.execute-api.{region}.amazonaws.com/{stage}"  # Replace with your actual values
)
If you don’t use this format, you’ll get 403 Forbidden even with the right IAM permissions.

2. Connection ID Might Be Expired or Closed Even with the correct endpoint, you'll get a ForbiddenException if the connection ID is no longer valid (the client disconnected or timed out).

To confirm this, catch the GoneException

try:
    apigw_client.post_to_connection(
        ConnectionId=conn_id,
        Data=b'Your message here'
    )
except apigw_client.exceptions.GoneException:
    print(f"Client {conn_id} disconnected.")
except apigw_client.exceptions.ForbiddenException:
    print("ForbiddenException: Check if you're using the correct endpoint or expired connection ID.")

3. Double-Check IAM Policy Format Even if your IAM policy includes execute-api:ManageConnections, the Resource ARN must match the exact format: { "Effect": "Allow", "Action": "execute-api:ManageConnections", "Resource": "arn:aws:execute-api:{region}:{account}:{api-id}/{stage}/POST/@connections/*" } If you’re using wildcards or broader ARNs, make sure they align with what your WebSocket API actually uses.

4. Check for SCP Restrictions (if using AWS Organizations) If you're part of an AWS Org, Service Control Policies (SCPs) might be blocking this action , even if IAM allows it. -->Ask your Org admin to check if there's an SCP that denies execute-api:ManageConnections -->You can test this using the IAM Policy Simulator

5. VPC + NAT Setup Seems Good (but Confirm DNS too) You've tested outbound HTTPS to Google, so internet access is likely fine. Just confirm: --> Your VPC subnets have DNS resolution enabled --> You're not using VPC endpoints that restrict outbound routes for some services

Thanks for confirming the IAM setup, VPC/NAT, and DNS, that narrows things down significantly.

Here's one last critical point to double-check: Are you 100% sure that the endpoint_url for apigatewaymanagementapi matches your actual deployed WebSocket stage URL?

Even one small mismatch (e.g., wrong region, stage name, or missing HTTPS schema) will always result in a ForbiddenException, no matter how perfect your IAM policy is.

Please verify this:

import boto3

apigw_client = boto3.client(
    'apigatewaymanagementapi',
    endpoint_url="https://<your-api-id>.execute-api.<region>.amazonaws.com/<stage>"
)

Tip: You can get the exact WebSocket endpoint from the API Gateway console → WebSocket API → Stages tab → copy the Invoke URL.

And additionally: If you're still getting ForbiddenException, let’s rule out this very specific scenario:

** SCP/Org restriction simulator test:** Use [AWS Policy Simulator]and test:

•     Action: execute-api:ManageConnections
  

•     Resource: "arn:aws:execute-api:<region>:<account-id>:<api-id>/<stage>/POST/@connections/*"
  

•     Use your Lambda role’s full ARN and check if the result is “Allowed”.
  

If it's not allowed, that confirms an SCP or permission boundary is silently blocking the call.

Final suggestion: If all the above checks are green and it still fails, try calling get_connection() before post_to_connection() to test if the connection is still active:

try:
    apigw_client.get_connection(ConnectionId=conn_id)
    apigw_client.post_to_connection(
        ConnectionId=conn_id,
        Data=b'Your message here'
    )
except apigw_client.exceptions.GoneException:
    print(f"Client {conn_id} disconnected.")
except apigw_client.exceptions.ForbiddenException as e:
    print("Still hitting Forbidden — let’s dig deeper.")

Happy to take a look at an anonymized config snippet if you want to share! You're very close, just one detail away.

Root Cause #1: SCP Blocking ManageConnections Even with a perfect IAM policy, if your AWS Org enforces Service Control Policies (SCPs) and doesn’t explicitly allow execute-api:ManageConnections, you'll still hit a ForbiddenException. Fix:** Ask your Org admin to verify if the SCPs attached to your account or OU are allowing this action. You can also confirm via the IAM Policy Simulator:

• Role ARN: Your Lambda execution role
• Action: execute-api:ManageConnections
• Resource: arn:aws:execute-api:us-east-1:123456789012:a1b2c3d4e5/prod/POST/@connections/* If the simulator returns “Denied”, that’s your blocker — not IAM, not VPC.

Root Cause #2: Stale or Misaligned WebSocket Endpoint Even if your WEBSOCKET_ENDPOINT looks right, a minor mismatch (wrong stage, old deploy, typo in API ID) will cause 403 Forbidden every time. Fix:

• Go to API Gateway → WebSocket API → Stages
• Select the correct stage (e.g., prod) → click “Invoke URL”
• Copy the exact endpoint (with region + stage) and update your Lambda code/env variable
• Re-deploy the stage just to avoid any internal drift

Additional: TLS Cert or VPC DNS Issue (Rare) If you’re in a private subnet and using custom DNS, TLS resolution may silently fail. In your Lambda, test explicitly:

import boto3
import urllib3
urllib3.disable_warnings()

apigw_client = boto3.client(
    'apigatewaymanagementapi',
    endpoint_url=os.environ['WEBSOCKET_ENDPOINT'],
    verify=True  # Fail loudly if TLS cert is invalid
)

Try setting verify=False only for testing; if it works, then it's likely a TLS or DNS trust issue. But never disable verification in production.

Based on your detailed troubleshooting, there are a few additional considerations that might explain the ForbiddenException you're encountering.

First, it's important to understand that Lambda functions never actually run in your VPC. They always run in the Lambda service VPC, and when you configure VPC access, AWS creates an Elastic Network Interface (ENI) in your VPC and routes all the Lambda's network traffic through that ENI.

When your Lambda function needs to send messages via WebSocket to clients using the API Gateway Management API's PostToConnection operation, it needs to communicate with API Gateway's public @connections URL. While you've confirmed internet access through your NAT Gateway setup, there are some specific aspects to check:

1. SigV4 Signing: When making requests to API Gateway endpoints, especially from within a VPC, requests often need to be properly signed with AWS Signature Version 4 (SigV4). The "ForbiddenException" could indicate that your request is not being properly authenticated. Ensure your Lambda function is using the AWS SDK correctly to sign the request.

2. API Gateway Endpoint Configuration: If you're using a private API Gateway endpoint, verify that the endpoint policy allows access from your Lambda function. Even with the correct IAM permissions, endpoint policies can restrict access.

3. Connection URL Format: Ensure you're using the correct format for the connection URL. It should typically be in the format: https://{api-id}.execute-api.{region}.amazonaws.com/{stage}/@connections/{connection-id}

4. Connection ID Validity: Verify that the connection IDs you're trying to post to are still valid. WebSocket connections might have been closed or timed out.

5. Cross-Account Access: If your API Gateway and Lambda are in different AWS accounts, additional permissions might be required.

6. Service Control Policies (SCPs): As you suspected, SCPs at the organization level could be restricting this action. This is worth investigating with your organization's administrators.

7. API Gateway Stage Variables: If you're using stage variables in your API Gateway configuration, ensure they're correctly set up and accessible.

If you've truly exhausted all these possibilities, I would recommend enabling detailed CloudWatch Logs for both your Lambda function and API Gateway to capture more specific error information, which might provide additional clues about the exact cause of the ForbiddenException.
Sources
About API Gateway Websocket and Lambda Invoke in VPC | AWS re:Post
Error Invoking Private REST API from Lambda Function | AWS re:Post
Connecting Lambda inside a VPC to resources outside a VPC | AWS re:Post