Is it possible to have an HTTP API Gateway in account A invoke another HTTP API Gateway in account B using an HTTP proxy or HTTP URI integration and IAM auth for requests between the API Gateways?

Yes, it's possible to route requests from HTTP API Gateway in Account A to another in Account B using IAM authorization.

Here's how to set it up:

1. Configure API Gateway B (Account B):

   a. Enable IAM authorization (Console):

   • Open API Gateway console
   • Select your API
   • Go to "Authorization" settings
   • Choose "AWS_IAM" as the authorizer

   b. Add resource policy (CLI):

   aws apigateway update-rest-api --rest-api-id API-B-ID --patch-operations '[
     {
       "op": "replace",
       "path": "/policy",
       "value": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::ACCOUNT-A-ID:root\"},\"Action\":\"execute-api:Invoke\",\"Resource\":\"arn:aws:execute-api:REGION:ACCOUNT-B-ID:API-B-ID/*\"}]}"
     }
   ]'

2. Set up API Gateway A (Account A):

   a. Create HTTP API (Console):

   • Open API Gateway console
   • Click "Create API" > "HTTP API"
   • Name your API and click "Next"

   b. Add HTTP integration (Console):

   • In "Configure routes", click "Add integration"
   • Choose "HTTP" as the integration type
   • Enter API B's endpoint URL
   • Set method to "ANY"

   c. Create IAM role (CLI):

   aws iam create-role --role-name APIGatewayARole --assume-role-policy-document '{
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Principal": {"Service": "apigateway.amazonaws.com"},
       "Action": "sts:AssumeRole"
     }]
   }'
   
   aws iam put-role-policy --role-name APIGatewayARole --policy-name InvokeAPIB --policy-document '{
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": "execute-api:Invoke",
       "Resource": "arn:aws:execute-api:REGION:ACCOUNT-B-ID:API-B-ID/*"
     }]
   }'

3. Configure request signing (Console):

   • In API Gateway A console, go to your API
   • Select the integration
   • Under "Integration request", add these headers:
     • X-Amz-Date: $context.requestTime
     • Authorization: $context.authorizationToken
     • X-Amz-Security-Token: $context.identity.sessionToken

4. Deploy API A (CLI):

   aws apigateway create-deployment --rest-api-id API-A-ID --stage-name prod

Yes — it's definitely possible to route HTTP requests from API Gateway A (in Account A) to API Gateway B (in Account B) using IAM authorization. That said, it does require a few key pieces to line up correctly:

IAM Permissions: API Gateway A will need an IAM role with permission to call execute-api:Invoke on Gateway B’s resources.

Resource Policy in Account B: You’ll need to add a resource policy to API Gateway B that explicitly allows the principal from Account A to call it. This is what bridges the trust between accounts.

Request Signing: IAM-based authorization requires signed requests. API Gateway can sign requests for you if you configure the integration properly — usually with an IAM role assumption and appropriate headers (like X-Amz-Date, Authorization, etc.).

Avoid Manual Signing (if possible): Instead of manually setting Authorization headers in the console, it’s often easier to configure IAM authorization directly in the integration, or consider using Lambda proxy as an intermediary if things get complex.

Lastly, make sure the endpoint type (Regional vs. Edge) is compatible with IAM auth and doesn’t introduce unexpected latency or CORS behavior.