ApiGatewayV2::Authorizer - "Internal Failure"

Question

Hi, I'm trying to create an API Gateway authorizer via CloudFormation, and am getting "Internal Failure" when adding the API Autorizer shown below on deploying.  Here's the segment:

```yaml
  ApiAuthorizer:
    Type: AWS::ApiGatewayV2::Authorizer
    Properties:
      Name: MyCustomAuthorizer
      # "Api" is my CloudFormation API which gets created ok...
      ApiId: $Ref Api
      AuthorizerType: REQUEST
      # AuthorizerFunctionARN is a parameter set to the Lambda function's ARN
      AuthorizerUri:
        'Fn::Sub': >-
          arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${AuthorizerFunctionARN}/invocation      
      # I've tried with and without AuthorizerCredentialsArn
      AuthorizerCredentialsArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/APIGatewayLambdaInvokeRole"
      IdentitySource:
        - route.request.header.Auth

ApiAuthorizerPermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !Ref AuthorizerFunctionARN
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${Api}/authorizers/${ApiAuthorizer}" 
```

I found [this on GitHub](https://github.com/aws-samples/simple-websockets-chat-app/issues/22) and [this on StackOverflow](https://stackoverflow.com/questions/47521422/api-gateway-createauthorizer-fails-with-internalfailure) but not making any headway.  Is there a way to get more detailed error info from CloudFormation than "Internal Failure"? Is there some permissions I need to set up?  TIA

Answer

In general, CloudTrail event history helps to get more information on any error occurred in CloudFormation deployment. 
This link might be helpful in reviewing Event history https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html
In this case, you can filter using Event Name (CreateAuthorizer) OR Event source (apigateway.amazonaws.com) or Username (IAM Role used by CloudFormation to deploy resources).

Also, in order to isolate the issue, you can try creating an authorizer with similar configuration on API Gateway console and see if that gets created successfully. Then it might be an issue with CloudFormation.

ApiGatewayV2::Authorizer - "Internal Failure"

Relevant content