I have a lambda and a vpc endpoint in account a. I have configured the Lambda to be in the same vpc and subnets/security group as the VPC Endpoint. In account b, I have a private api, which I am trying to call from the lambda in account a.
In the code for my lambda, I am a bit confused when trying to invoke this. This is code from my lambda_handler function:
headers = {
'Host': f"{api_id}.execute-api.{region}.amazonaws.com",
'x-apigw-api-id': api_id,
'Content-Type': 'application/json' # Set content type to JSON
}
# Extract the payload from the event
payload = json.loads(event.get('body', '{}'))
http = urllib3.PoolManager()
try:
# Make a POST request to the private API in Account B
encoded_data = json.dumps(payload).encode('utf-8')
response = http.request(
'POST',
vpce_url,
body=encoded_data,
headers=headers
)
# Check if the request was successful
if response.status == 200:
return {
'statusCode': 200,
'body': json.dumps({
'message': 'Request to private API was successful',
'data': json.loads(response.data.decode('utf-8'))
})
}
else:
return {
'statusCode': response.status,
'body': json.dumps({
'message': 'Failed to invoke private API',
'error': response.data.decode('utf-8')
})
}
except Exception as e:
return {
'statusCode': 500,
'body': json.dumps({
'message': 'Error invoking private API',
'error': str(e)
})
}
vpce_url is my vpc endpoint dns name in account a
api_url is the invoke url for my private api in account b
I am unsure which I should be using to call the http.request with urllib3. I am also unsure if I am redirecting the vpce correctly to the private api by using the request headers, specifically Host and x-apigw-api-id.
When doing this, I am getting a message that just says 403 - Forbidden. I have the host and the x-apigw-api-id in the headers and am using the vpc endpoint as the url for the http.requests call
You can try following this troubleshooting article: https://repost.aws/knowledge-center/api-gateway-private-endpoint-connection and https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html