CODEWITHSUNDEEP
amazon-web-servicesaws-lambdaaws-api-gatewayamazon-iam
Javier Lopez Tomas
Javier Lopez Tomas

Reputation: 2352

API Gateway does not have permission to assume the provided role

I am trying to invoke a lambda function from an API Gateway. I have followed the next tutorial: https://docs.aws.amazon.com/apigateway/latest/developerguide/integrating-api-with-aws-services-lambda.html

However, I get the following error when I test it from the web of API Gateway:

Execution failed due to configuration error: API Gateway does not have permission to assume the provided role

I have search in google and I have not been able to solve it (this, for instance).

If I go to the IAM Management Console, I can see that the trust relationship allows API Gateway to assume the rol, and the JSON of the trust relationship is the following:

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "apigateway.amazonaws.com",
          "lambda.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

I have tried also with:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "lambda.amazonaws.com",
          "apigateway.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

The policy of the role is the next:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

What is wrong here? Thank you

Upvotes: 3

Views: 15685

Answers (2)

Swapnil Sharma
Swapnil Sharma

Reputation: 21

To fix this go to the role in your IAM and select the “Trust Relationships” tab. From here edit the policy and for the Principal Service add in “apigateway.amazonaws.com” as seen below. This will grant the API Gateway the ability to assume roles to run your function in addition to the existing lambda permission.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "apigateway.amazonaws.com",
          "lambda.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Upvotes: 2

error404
error404

Reputation: 2823

I guess you have not attached the role to the invoking method i.e the api gateway

Attaching the created role to the api gateway is needed for api to execute the lamda.

Under Execution role, choose Choose an existing role.

Enter the role ARN for the lambda_invoke_function_assume_apigw_role role you created earlier.

Choose Save.

AWS Link

Upvotes: 0

Related Questions