Examkin

Question

Difficulty: MediumTroubleshooting API Gateway Errors and CORS

A client-side Vue.js application hosted on `https://portal.health-insights.com` receives a `403 Forbidden` error with the message 'User is not authorized to access this resource' when attempting to fetch a user's health report. The application interacts with an Amazon API Gateway REST API secured by a custom Lambda Authorizer. The authorizer has caching enabled with a TTL of 300 seconds and is configured with `method.request.header.Authorization` as the identity source. The authorizer function dynamically builds an IAM policy that sets the `Resource` element to the incoming request's `event.methodArn` (for example, `arn:aws:execute-api:us-east-1:123456789012:apiId/prod/GET/user/profile`). A user successfully logs in and views their profile (`GET /user/profile`), but immediately receives the `403 Forbidden` error when navigating to view their reports page (`GET /user/reports`). How should the developer resolve this issue?

  1. Modify the Lambda Authorizer to return an IAM policy with a wildcard resource path (such as `arn:aws:execute-api:us-east-1:123456789012:apiId/prod/*/*`) instead of the specific `event.methodArn` value.Answer
  2. B
    Replace the Lambda Authorizer with a Cognito User Pool Authorizer and configure API Gateway to dynamically generate IAM policies for each distinct HTTP method.
  3. C
    Enable CORS on the API Gateway and add the `Access-Control-Allow-Origin` header to the S3 bucket hosting the client-side application.
  4. D
    Change the API Gateway integration type from Lambda Proxy to Lambda Custom integration and format the authorizer's output as a JSON payload containing the statusCode and body keys.

Answer

Modify the Lambda Authorizer to return an IAM policy with a wildcard resource path (such as `arn:aws:execute-api:us-east-1:123456789012:apiId/prod/*/*`) instead of the specific `event.methodArn` value.
When caching is enabled on an API Gateway Lambda Authorizer, API Gateway uses the cached IAM policy for subsequent requests with the same token. If the policy specifies the exact `event.methodArn` (e.g., `/GET/user/profile`), any subsequent request to a different path (e.g., `/GET/user/reports`) using the same token will fail because the cached policy does not grant permission to that path. Replacing the specific path with a wildcard resource path allows the cached policy to authorize other paths during the cache TTL period.

Step-by-Step Solution

1
Analyze the cause of the `403 Forbidden` response.
The custom Lambda Authorizer has caching enabled for 300 seconds, keyed by the Authorization header.
This means that after the first call to `GET /user/profile`, API Gateway caches the returned policy for subsequent calls with the same token.
2
Examine the policy's Resource element.
The authorizer generates a policy scoped strictly to the current request's `event.methodArn` (which is `GET /user/profile`).
Since the cached policy only grants access to `GET /user/profile`, the subsequent request to `GET /user/reports` is evaluated against this cached policy and denied.
3
Update the policy generation logic.
Modify the authorizer to use wildcards in the Resource ARN (e.g., `/prod/*/*` or `/*`) so the cached policy allows access to multiple paths under the API.
This ensures the cached policy is broad enough to permit or deny other authorized routes for the same user within the cache TTL.

Key Concept

API Gateway Lambda Authorizer Caching and Policy Scope
Rate this question

Topics

Troubleshooting API Gateway Errors and CORS

More questions from this topic