How do I troubleshoot HTTP 403 errors from API Gateway?

Key Takeaways

[music] Hello, I'm Sahil, a cloud support engineer here at the AWS office in Bangalore. Today I'm going to show you how to troubleshoot HTTP 403 forbidden errors that occur when calling APIs hosted on Amazon API gateway. Let's get started. When a client can't access a valid URL, you get an HTTP 403 forbidden response code, the server understands the request but can't fulfill it because of the client side issues. API gateway can return 403 forbidden errors for various reasons. Let's take a look at how to identify and troubleshoot these 403 forbidden errors. For this demonstration, let's say that we have a regional rest API with a basic as Lambda integrations. When we try to invoke the API from an Amazon Elastic Compute Cloud instance which is having a public internet access, we get the 403 error. To identify the root cause of the issue when invoking the API through the curl command, we first have to identify the following error characteristics. Error response header X Amazon error type error message error status code in the curl commands response. We can see that we are getting the error access denied exception in the response header X Amazon error type with the status code as 403 forbidden. The error message appears as user anonymous is not authorized to perform execute API invoke action on my API gateway source with an explicit deny. The error message could be because of either the caller isn't authorized to access an API that uses IM authorization or the API has an attached resource policy that doesn't explicitly allow the caller to invoke the API. For more information, see IM authentication and the resource policy. The first root cause is because of AWS identity and access management authorization. In this case, I don't have IM authorization attached in my method request for my API. So, this root cause isn't applicable. Now, let's look at the second root cause where my resource policy is denying access to the API. As we can see, I have a resource policy that denies all invocation on my resource. To resolve this issue, allow access to invoke this API in its resource policy. Make sure that you redeploy the API whenever there are any changes in the resource policy. Now, let's make a request to the rest API endpoint from Amazon EC2 instance. The request returns a 200 okay status code with a desired response. Now let's talk about how to troubleshoot the 403 forbidden error and find the response headers when invoking the API from any browser or third party API testing tools such as postman. For this demonstration we have a regional rest API which has a basic AWS Lambda integration. When we try to invoke the API from a browser, we get the error message forbiddenness. Let's take a look at the response headers for this request. Right click anywhere on the browser web page. Select inspect. Navigate to the network tab. As we can see, we are getting the response headers X Amazon error type forbidden exception when we invoke the rest API. Let's try invoking the API through the third party API testing tool Postman. When invoking the API using the same API gateway invocation URL, we get the error message forbidden. Let's check the response headers in the headers tab. We can see that we are getting the X Amazon error type forbidden exception error response header. The error message could be because of multiple reasons. One of the reasons is the caller request URL includes a stage that doesn't exist. This reason means that I'm invoking the API with an incorrect stage name for my API. Let's take a look at my API gateway stage. I have deployed the API with a stage name prod while I'm invoking the API with a stage name which doesn't exist in my API. Let's invoke the API with the correct stage name from the browser and Postman. When we use the correct stage invocation URL, we can see successful API invocation and request returning 200 okay status with the desired response. For more information about troubleshooting 403 forbidden errors, refer to the knowledge center article linked in the video description below. And now you know how to troubleshoot HTTP 403 forbidden errors that occur when calling APIs hosted on Amazon API gateway. Thanks for watching and happy cloud computing from all of us here at AWS. [music]