title: What security requirements are expected by AWS API Gateway by default? BG96 fails on API Gateway GET Request
body: <p>I wish to hit some API Gateway HTTPS end points using a BG96 for an IoT project. I have set up a GET method using AWS API Gateway that retrieves an entry from a DynamoDB table given the entry ID and a Lambda function to process the request. The end point does not require an API key nor AWS IAM role for authorization, it is open.</p>
  <pre><code>API URL: htttps://...amazonaws.com/dev/data/{id}
  </code></pre>
  <p>I can perform a GET request on the end point successfully using Postman however if I use the Quectel BG96 I receive a 403 Forbidden error and there's no log of the Lambda function ever being called which makes me thing the request is being blocked before reaching the Lambda Function. If I request a different HTTPS endpoint (not the one I created on API Gateway, e.g. <a href="https://www.alipay.com/" rel="nofollow noreferrer">https://www.alipay.com/</a>) using the BG96 I am successful.</p>
  <p>Success - Example output below is for an HTTP endpoint but it does work for HTTPS end points as well.</p>
  <pre><code>[2022-02-03 15:25:19:468_R:] +QHTTPGET: 0,200,260
  [2022-02-03 15:25:19:727_S:] AT+QHTTPREAD=80
  [2022-02-03 15:25:19:780_R:] AT+QHTTPREAD=80
  [2022-02-03 15:25:19:780_R:] CONNECT
  [2022-02-03 15:25:19:780_R:] HTTP/1.1 200 OK
  [2022-02-03 15:25:19:780_R:] Date: Thu, 03 Feb 2022 04:25:19 GMT
  [2022-02-03 15:25:19:780_R:] Content-Type: application/json
  [2022-02-03 15:25:19:780_R:] Content-Length: 260
  [2022-02-03 15:25:19:780_R:] Connection: keep-alive
  [2022-02-03 15:25:19:780_R:] Server: gunicorn/19.9.0
  [2022-02-03 15:25:19:780_R:] Access-Control-Allow-Origin: *
  [2022-02-03 15:25:19:780_R:] Access-Control-Allow-Credentials: true
  
  [2022-02-03 15:25:19:780_R:] {
  [2022-02-03 15:25:19:780_R:]   &quot;args&quot;: {}, 
  [2022-02-03 15:25:19:780_R:]   &quot;headers&quot;: {
  [2022-02-03 15:25:19:780_R:]     &quot;Accept&quot;: &quot;*/*&quot;, 
  [2022-02-03 15:25:19:780_R:]     &quot;Host&quot;: &quot;httpbin.org&quot;, 
  [2022-02-03 15:25:19:780_R:]     &quot;User-Agent&quot;: &quot;QUECTEL_MODULE&quot;, 
  [2022-02-03 15:25:19:780_R:]     &quot;X-Amzn-Trace-Id&quot;: &quot;Root=1-61fb592f-4fd419b62b1b51ff0b9acb08&quot;
  [2022-02-03 15:25:19:780_R:]   }, 
  [2022-02-03 15:25:19:780_R:]   &quot;origin&quot;: &quot;115.187.131.157&quot;, 
  [2022-02-03 15:25:19:780_R:]   &quot;url&quot;: &quot;https://httpbin.org/get&quot;
  [2022-02-03 15:25:19:780_R:] }
  
  [2022-02-03 15:25:19:780_R:] OK
  
  [2022-02-03 15:25:19:780_R:] +QHTTPREAD: 0
  </code></pre>
  <p>Failure</p>
  <pre><code>[2022-02-03 15:01:10:606_R:] +QHTTPGET: 0,403,23
  [2022-02-03 15:01:13:912_S:] AT+QHTTPREAD=80
  [2022-02-03 15:01:13:964_R:] AT+QHTTPREAD=80
  [2022-02-03 15:01:13:964_R:] CONNECT
  [2022-02-03 15:01:13:964_R:] HTTP/1.1 403 Forbidden
  [2022-02-03 15:01:13:964_R:] Date: Thu, 03 Feb 2022 04:01:10 GMT
  [2022-02-03 15:01:13:964_R:] Content-Type: application/json
  [2022-02-03 15:01:13:964_R:] Content-Length: 23
  [2022-02-03 15:01:13:964_R:] Connection: keep-alive
  [2022-02-03 15:01:13:964_R:] x-amzn-RequestId: 92420321-1e22-4967-8b9e-22988aee1046
  [2022-02-03 15:01:13:964_R:] x-amzn-ErrorType: ForbiddenException
  [2022-02-03 15:01:13:964_R:] x-amz-apigw-id: M8n9FGhfSwMFdRA=
  
  [2022-02-03 15:01:13:964_R:] {&quot;message&quot;:&quot;Forbidden&quot;}
  [2022-02-03 15:01:13:964_R:] OK
  
  [2022-02-03 15:01:13:964_R:] +QHTTPREAD: 0
  </code></pre>
  <p>By default Postman appears to be using TLSv1.2 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 encryption. I am wondering if the cause of rejection of the BG96 is because I haven't set security correctly. The following is the list of AT commands I use to set the BG96 and perform the GET request, note I'm setting TLSv1.2 and cipher TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 but also setting security level to 0 meaning no certificate is required which is where it might fall down:</p>
  <pre><code>AT+QHTTPCFG=&quot;contextid&quot;,1
  AT+QHTTPCFG =&quot;responseheader&quot;,1
  AT+QIACT?
  AT+QICSGP=1,1,&quot;iot.truphone.com&quot;,&quot;&quot;,&quot;&quot;,1
  AT+QIACT=1
  AT+QIACT?
  AT+QHTTPCFG=&quot;SSLCTXID&quot;,1
  AT+QSSLCFG=&quot;SSLVERSION&quot;,1,3
  AT+QSSLCFG=&quot;ciphersuite&quot;,1,0XC02F
  AT+QSSLCFG=&quot;seclevel&quot;,1,0
  AT+QHTTPURL=&lt;url len in char&gt;,&lt;timeout in seconds&gt;
  CONNECT
  &lt;enter url&gt;
  AT+QHTTPGET=80
  AT+QHTTPREAD=80
  </code></pre>
  <p>A better question might be what security does API Gateway RESTful endpoints require by default? Is a certificate always necessary?</p>