Lambda function -> Api Gateway stage variable permission manually

Question

You defined your Lambda function as a stage variable; you must manually give permissions to all the functions you will use. You can do this by running the below AWS CLI command for each function, replacing the stage variable in the function-name parameter with the necessary function name.

aws lambda add-permission --function-name arn:aws:lambda:eu-west-1:12345:function:test${stageVariables.functionAlias} --source-arn arn:aws:execute-api:eu-west-1:12345:dsad667asd/*/GET/test/test --principal apigateway.amazonaws.com --statement-id d5a14508-22bb-4413-87c9-d9715e36435d --action lambda:InvokeFunction

Getting this message and suggestion to run this command , unfortunately it does not work here throwing

zsh: bad substitution

with or without zsh, what I am looking is a way to do this manualy (using aws interface)

thanks!

There are limitations in the AWS Console that mean that some particular combinations of permission are not possible to assign through the Console, and require a CLI command to implement. Lorenzo's answer gives the reason your CLI command didn't work. There is an alternative which is to provide an ARN of an IAM role to the API Gateway in the integration to provide invokeLambda permission. You can set up your IAM role permissions how you wish in the Console I believe. — NeilG
– NeilG, Commented Aug 21, 2023 at 9:26

Lorenzo d · Accepted Answer · 2016-02-26 06:20:52Z

Did you leave the "${stageVariables.functionAlias}" in your command? The --function-name parameter of this command needs to a valid fully-qualified or partial lambda function ARN following the pattern of:

(arn:aws:lambda:[region]:[account-id]:function:)[function-name](:[function-alias])

Where region, account-id, function-name and function-alias are substituted as appropriate.

If your function is in the same account and region as the user issuing the command, and you simply want to refer to the $LATEST function version, specifying just the function name would be perfectly valid and save a few keystrokes:

aws lambda add-permission --function-name test --source-arn arn:aws:execute-api:eu-west-1:12345:dsad667asd/*/GET/test/test --principal apigateway.amazonaws.com --statement-id d5a14508-22bb-4413-87c9-d9715e36435d --action lambda:InvokeFunction

See this document on usage of the aws lambda add-permission CLI command: http://docs.aws.amazon.com/cli/latest/reference/lambda/add-permission.html

Winters Huang · Accepted Answer · 2016-10-19 00:54:24Z

1

You need to replace ${stageVariables.functionAlias} to your own lambda function name from the command.

Also, make sure AWS environment variables setup correct in your bash.

It works for me.

answered Oct 19, 2016 at 0:54

Winters Huang

82111 silver badges19 bronze badges

1 Comment

NeilG Over a year ago

As described much more clearly and sufficiently by Lorenzo's answer, 6 months earlier. This answer is basically just spam.

Vanessa Plugues · Accepted Answer · 2017-08-01 18:02:14Z

1

What I did to figure this out, is I created the versions I needed, created aliases to each version. In my case I had Production pointing to Version 1, and Development pointing to $LATEST.

On the AWS CLI I changed the ${stageVariables.functionAlias} to the name of the alias, and performed that command for each alias.

I also referenced Using API Gateway Stage Variables. You can also look at the logs in CloudWatch for your endpoint and see which version/alias was called.

Hope this helps.

answered Aug 1, 2017 at 18:02

Vanessa Plugues

111 bronze badge

1 Comment

NeilG Over a year ago

As described more clearly by Lorenzo's answer, 18 months earlier. This answer just adds to the noise.

ozkary · Accepted Answer · 2019-08-20 18:59:24Z

0

When a new function or new function alias is created, a permission must be added to enable the access to the API gateway. The way I do this is during the integration request, I enter the lambda function stage variable like:

${stageVariables.myFunctionName}

I run the command (shown by the console) on the CLI and replace the above variable with this format:

myFunctionName:myAliasName

Notice that if an alias was created, add the alias name after the function name separated by a single ":" colon

Note: You can get the function and alias name from the Lammda>functions > Qualifiers options.

I hope this helps.

edited Aug 20, 2019 at 18:59

answered Aug 5, 2019 at 22:49

ozkary

2,7241 gold badge23 silver badges20 bronze badges

1 Comment

NeilG Over a year ago

Another confusing answer that struggles to replicate Lorenzo's answer, from years earlier.

Lindsay Glenn · Accepted Answer · 2022-09-09 09:24:37Z

0

As of September 2022, I just followed the steps from this post and I can access the env variables through event.stageVariables in the lambda function. No need for any aws-cli manual configuration

answered Sep 9, 2022 at 9:24

Lindsay Glenn

1

Collectives™ on Stack Overflow

Lambda function -> Api Gateway stage variable permission manually

5 Answers 5

Comments

1 Comment

1 Comment

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

1 Comment

1 Comment

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related