API Gateway Authorization failure for an authenticated Identity

Question

Hi,

First, I am pretty new to AWS ...

I try to invoke an API in the AWS API Gateway from a Google OAuth Client App. I set up successfully an identity pool in Cognito with Google as Identity provider.
This identity pool gives user access to an authenticated role by default with "AmazonAPIGatewayInvokeFullAccess" and "Cognito-authenticated" policies.

When requesting the Cognito service from my Google OAuth Client app, the "google" user of my app is identified in Cognito and I can get either a OpenId token calling "AWSCognitoIdentityService.GetOpenIdToken" or either AWS credentials calling "AWSCognitoIdentityService.GetCredentialsForIdentity"

Then, i have an Api in the API Gateway service set with the IAM Authorization mechanism.

From there, I am stuck to call my API hosted in the API Gateway service from my Google OAuth Client app or Postman : when passing the OpenId token returned by Cognito in request.headers.Authorization, i receive a 403 error {"message ": "forbidden"}.

Could someone can help me and tell me where I am wrong ?

Thanks,

Seb

Answer

Assuming you are invoking a REST API via APIGW, you may want to look at a couple of options:
1. [Lambda Authorizer](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html)
2. Cognito User Pool [Authorizer](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-integrate-with-cognito.html). Google can be [setup](https://repost.aws/knowledge-center/cognito-google-social-identity-provider) as an Identity Provider for the user pool

API Gateway Authorization failure for an authenticated Identity

Relevant content