Examkin

Question

Difficulty: MediumAPI Development and Integration with Amazon API Gateway

A developer is configuring an Amazon API Gateway REST API with a Lambda integration. To manage deployments across different environments, the developer defines a stage variable named envenv and configures the integration request to dynamically target a Lambda function alias using the format `my-function:stageVariables.env‘.AfterdeployingtheAPItoastagewhere{stageVariables.env}`. After deploying the API to a stage where env issetto‘prod‘,clientsreceivea is set to `prod`, clients receive a 500$ Internal Server Error. The API Gateway execution logs show a permission error when attempting to invoke the Lambda function. Which action should the developer take to resolve this issue?

  1. Use the AWS CLI to run the `aws lambda add-permission` command, granting the API Gateway service principal (`apigateway.amazonaws.com`) permission to perform the `lambda:InvokeFunction` action on the specific Lambda function alias.Answer
  2. B
    Update the Lambda function's execution role trust policy to allow the API Gateway service principal (`apigateway.amazonaws.com`) to assume the role.
  3. C
    Enable Lambda Proxy Integration in the integration request to allow API Gateway to bypass Lambda resource-based policy checks.
  4. D
    Configure a VTL mapping template in the Integration Request to forward the stage variables inside the request payload.

Answer

Use the AWS CLI to run the `aws lambda add-permission` command, granting the API Gateway service principal (`apigateway.amazonaws.com`) permission to perform the `lambda:InvokeFunction` action on the specific Lambda function alias.
The correct answer is correct because when you use stage variables to dynamically specify a Lambda function in API Gateway, the console cannot automatically add the resource-based policy permission to the Lambda function. You must manually grant invocation permissions to the API Gateway service principal (`apigateway.amazonaws.com`) using the `aws lambda add-permission` command for the specific alias that will be resolved at runtime.

Step-by-Step Solution

1
Analyze the error cause from the logs.
The API Gateway logs indicate a permission failure trying to invoke the backend Lambda function.
API Gateway needs explicit invocation permissions to trigger a Lambda function or alias.
2
Identify why permissions were not automatically configured.
Using the stage variable syntax `my-function:${stageVariables.env}` prevents the console from defining static permissions during configuration.
Because the runtime target is resolved dynamically, permissions must be explicitly set for each potential target function/alias.
3
Grant the required permissions.
Run `aws lambda add-permission` for the targeted Lambda function alias to allow API Gateway to invoke it.
This modifies the Lambda function's resource-based policy to allow the API Gateway service principal (`apigateway.amazonaws.com`) to call the function.

Key Concept

API Gateway stage variables and resource-based invocation permissions for Lambda integrations
Rate this question

Topics

API Development and Integration with Amazon API Gateway

More questions from this topic