By using AWS re:Post, you agree to the Terms of Use

CloudFront + API Gateway AWS_IAM Authorization


I have an endpoint in API Gateway that has AWS_IAM Authorization enabled. If the endpoint is called directly everything works OK, provided that the request is signed correctly.

I am trying to put a CloudFront distribution in front of it, I have configured origin and cache behavior; the Authorization header is allowlisted and forwarded to API Gateway.

When I try to call the endpoint using the CloudFront url I get a signature error like this:

The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method.

I suspect that the issue is related to the fact that the client is signing the request for the CloudFront URL but when the signature is checked on the API Gateway/IAM side the url doesn't match, is that so?

What am I missing? I know I could reach for a Lambda@Edge to essentially re-sign the request but since I followed these instructions it should be possible without right?

1 Answer
Accepted Answer

I was able to make it work by using a FQDN and setting it up as Custom Domain on the API Gateway. I used the same domain on the CloudFront distribution and made sure to forward the host header for the API endpoint that is protected with AWS_IAM.

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions