Lambda permission not being created when using cloudformation

Question

I am trying to create a simple infra using cloudformation. I have to create an Rest API Gateway and Lambda function. That function will be called using API Gateway.

Api Gateway > Lambda

The cloudformation code is below ( I am not showing the code related to role creation or managed policy).

    medtestFunction:
        Type: "AWS::Lambda::Function"
        Properties:
            Description: ""
            Environment: 
                Variables: 
                    APIID: !Ref medTestRestapi
                    SLACK_VERIFICATION_TOKEN:
                      Ref: SlackVerificationToken
                    SLACK_INCOMING_WEBHOOK_URL:
                      Ref: SlackIncomingWebhookURL
            FunctionName: "med-test2"
            Handler: "index.handler"
            Architectures: 
              - "x86_64"
            Code: 
                S3Bucket:
                  Ref: S3CodeBucket
                S3Key:
                  Ref: MedTestFunctionS3Key
            MemorySize: 128
            Role: !GetAtt medtestrole.Arn
            Runtime: "nodejs14.x"
            Timeout: 6
            TracingConfig: 
                Mode: "PassThrough"

medTestRestapi:
        Type: "AWS::ApiGateway::RestApi"
        Properties:
            Name: "medtest2"
            Description: "medtest2"
            ApiKeySourceType: "HEADER"
            EndpointConfiguration: 
                Types: 

  medTestApiStage:
        Type: "AWS::ApiGateway::Stage"
        Properties:
            StageName: "a"
            DeploymentId: !Ref medTestApiDeployment
            RestApiId: !Ref medTestRestapi
            Description: "a"
            CacheClusterEnabled: false
            TracingEnabled: false

    medTestApiMethod:
        DependsOn: medtestFunction
        Type: "AWS::ApiGateway::Method"
        Properties:
            RestApiId: !Ref medTestRestapi
            ResourceId: !GetAtt medTestRestapi.RootResourceId
            HttpMethod: "POST"
            AuthorizationType: "NONE"
            ApiKeyRequired: false
            RequestParameters: {}
            MethodResponses: 
              - 
                ResponseModels: 
                    "application/json": "Empty"
                StatusCode: "200"
            Integration:
                ContentHandling: "CONVERT_TO_TEXT"
                IntegrationHttpMethod: "POST"
                IntegrationResponses: 
                  - 
                    ResponseTemplates: {}
                    StatusCode: "200"
                PassthroughBehavior: "WHEN_NO_MATCH"
                TimeoutInMillis: 29000
                Type: "AWS_PROXY"
                Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:med-test2/invocations"


    medTestApiDeployment:
        DependsOn: medTestApiMethod
        Type: "AWS::ApiGateway::Deployment"
        Properties:
            RestApiId: !Ref medTestRestapi
            Description: "a"

    medTestFunctionPermission:
        DependsOn: [medTestApiDeployment, medTestApiMethod]
        Type: "AWS::Lambda::Permission"
        Properties:
            Action: "lambda:InvokeFunction"
            FunctionName: !GetAtt medtestFunction.Arn
            Principal: "apigateway.amazonaws.com"
            SourceArn: !Join [ ":", ["arn:aws:execute-api", !Ref AWS::Region, !Ref AWS::AccountId, !Ref medTestRestapi, "/*/POST/" ] ]

After stack creation when I am checking the function it says

The API with ID : could not be found.

But when I add the trigger manually using console on top of the created stack then it works. Any idea what I am doing wrong? Thanks

Answer 1

you've got one colon too many in SourceArn of medTestFunctionPermission The one just after the API Gateway ID

You have: arn:aws:execute-api:eu-west-1:<accountId>:<apiGWId>:/*/POST/

Should be: arn:aws:execute-api:eu-west-1:<accountId>:<apiGWId>/*/POST/

You can use !Sub instead of !Join. It's easier to read:

SourceArn: !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${medTestRestapi}/*/POST/