title: API Gateway CLI Lambda permission (add-permission)
body: <p>After going to tons of pages (including some SO ones) suggesting some advice (see list below), I am still not able to give my APIGateway access to execute a newly added Lambda function via the AWS CLI Command Line tool.</p>
  
  <p>i.e. I'm trying to replicate this: </p>
  
  <p><a href="https://i.stack.imgur.com/GEevU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GEevU.png" alt="image1"></a></p>
  
  <p>I've created a new endpoint, with the following integration setup:</p>
  
  <p><a href="https://i.stack.imgur.com/0CCb7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0CCb7.png" alt="enter image description here"></a></p>
  
  <p>As soon as I try and test it (from within the API Gateway Console), I get this </p>
  
  <pre><code>&lt;AccessDeniedException&gt;
    &lt;Message&gt;Unable to determine service/operation name to be authorized&lt;/Message&gt;
  &lt;/AccessDeniedException&gt;
  </code></pre>
  
  <p>I know that this is because, although I have added the lambda function to  the method, the APIGateway policy has still not been updated (image 1), hence, there are permission issues. </p>
  
  <p>If I re-add the function and allow the permissions automatically (via the AWS GUI) the testing and execution works fine.</p>
  
  <p>My current CLI command I am trying to execute is this (through PS):</p>
  
  <pre><code>aws lambda add-permission --function-name xx-url --statement-id apigateway-perm-1 --action lambda:InvokeFunction --principal apigateway.amazonaws.com --s
  ource-arn "arn:aws:execute-api:{REGION}:{AWS_ACCOUNT_ID}:{API_ID}/*/*"
  </code></pre>
  
  <p>I have tried multiple versions of the above <code>arn</code> address (including <code>/*/*</code> | <code>/{STAGE}/{METHOD}</code> | <code>/{STAGE}/{METHOD}/{RESOURCE}</code>)</p>
  
  <p>I've also tried deploying the API before and after these changes, with no effect? </p>
  
  <p><strong>PS</strong> - I've also read the suggestion of changing the integration type of the function to a POST (see <a href="https://forums.aws.amazon.com/thread.jspa?threadID=209420" rel="nofollow noreferrer">this</a> URL), but my requirement is to have a GET method, also - adding this GET method manually through the console works fine, hence, so should doing the same through the CLI tool.</p>
  
  <p>URL list (if anyone else is look for some resources on this issue / topic):</p>
  
  <ul>
  <li><a href="http://interworks.com.mk/aws-api-gateway-lambda-function-invocation-permissions-nuts-and-bolts/" rel="nofollow noreferrer">http://interworks.com.mk</a></li>
  <li><a href="https://docs.aws.amazon.com/cli/latest/reference/lambda/add-permission.html" rel="nofollow noreferrer">docs AWS</a></li>
  <li><a href="http://docs.aws.amazon.com/lambda/latest/dg/with-on-demand-https-example-configure-event-source.html" rel="nofollow noreferrer">docs AWS #2</a></li>
  <li><a href="http://docs.aws.amazon.com/cli/latest/reference/lambda/remove-permission.html" rel="nofollow noreferrer">remove-permission</a></li>
  </ul>
  
  <p><strong>UPDATE #1</strong></p>
  
  <p>I can also confirm that, after comparing the newly created <code>get-policy</code> against an existing, working one - they seem almost identical (just named differently):</p>
  
  <p>AWS CLI command used: <code>aws lambda get-policy --function-name {FunctionName}</code></p>
  
  <p>Result of already working policy vs. the newly created one:</p>
  
  <p><a href="https://i.stack.imgur.com/dXn88.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/dXn88.png" alt="enter image description here"></a></p>
  
  <p>This makes me suspect it could be an additional step I'm missing.</p>
  
  <p><strong>EDIT (per request)</strong></p>
  
  <p>Test screenshot - this log goes on to display the <code>AccessDeniedException</code> error.</p>
  
  <p><a href="https://i.stack.imgur.com/ZoKZl.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZoKZl.png" alt="enter image description here"></a></p>
  
  <p>Log as text (made a little shorter for readability):</p>
  
  <blockquote>
    <p>Execution log for request test-request
    Tue Mar 28 22:59:40 UTC 2017 : Starting execution for request: test-invoke-request
    Tue Mar 28 22:59:40 UTC 2017 : HTTP Method: GET, Resource Path: /api/v1/{path}
    Tue Mar 28 22:59:40 UTC 2017 : Method request path: {}
    Tue Mar 28 22:59:40 UTC 2017 : Method request query string: {fileName=x.doc}
    Tue Mar 28 22:59:40 UTC 2017 : Method request headers: {}
    Tue Mar 28 22:59:40 UTC 2017 : Method request body before transformations: 
    Tue Mar 28 22:59:40 UTC 2017 : Endpoint request URI: <a href="https://lambda.ap-southeast-2.amazonaws.com/2015-03-31/functions/arn:aws:lambda:ap-southeast-2" rel="nofollow noreferrer">https://lambda.ap-southeast-2.amazonaws.com/2015-03-31/functions/arn:aws:lambda:ap-southeast-2</a>:{accountid}:function:xx-url/invocations
    Tue Mar 28 22:59:40 UTC 2017 : Endpoint request headers: {X-Amz-Date=20170328T240Z, x-amzn-apigateway-api-id={resouceId}, Accept=application/json, Access-Control-Allow-Origin=*, User-Agent=AmazonAPIGateway_f, Host=lambda.ap-southeast-2.amazonaws.com, X-Amz-Content-Sha256=93438097f7627fe6203432b05e2257de86b32f74f8306, X-Amzn-Trace-Id=Root=1-58daeadc-bdd8f80d35834164c70, x-amzn-lambda-integration-tag=test-request, Authorization=*********************************************d309e7, X-Amz-Source-Arn=arn:aws:execute-api:ap-southeast-2:{AccountId}:{resourceId}/null/GET/api/v1/{path}, X-Amz-Security-Token=FQoDYXdzEDcaDAzSjIbAbD9j0wBjWFBxP++dR0+CGiK3flLOatlCr2 [TRUNCATED]
    Tue Mar 28 22:59:40 UTC 2017 : Endpoint request body after transformations: {"resource":"/api/v1/{path}","path":"/api/v1/{path}","httpMethod":"GET","headers":null,"queryStringParameters":{"fileName":"x.doc"},"pathParameters":null,"stageVariables":null,"requestContext":{"accountId":"{AccountId}","resourceId":"{AccountId}:{resourceId}","stage":"test-invoke-stage","requestId":"test-invoke-request","identity":{"cognitoIdentityPoolId":null,"accountId""{resourceId}","cognitoIdentityId":null,"caller":"ABPPLGO4:","apiKey":"test-invoke-api-key","sourceIp":"test-invoke-source-ip","accessKey":"ASHYYQ","cognitoAuthenticationType":null,"cognitoAuthenticationProvider":null,"userArn":"arn:aws:sts::111:assumed-role/AWS-Admins/{name}","userAgent":"Apache-HttpClient/4.5.x (Java/1.8.0_112)","user":"AROZBPPLGO4:{name}"},"resourcePath":"/api/v1/{path}","httpMethod":"GET","apiId":"{resourceId}"},"body":null,"isBase64Encoded":false}
    Tue Mar 28 22:59:40 UTC 2017 : Endpoint response body before transformations: </p>
  </blockquote>
  
  <p><code>&lt;AccessDeniedException&gt;
    &lt;Message&gt;Unable to determine service/operation name to be authorized&lt;/Message&gt;
  &lt;/AccessDeniedException&gt;</code></p>
  
  <blockquote>
    <p>Tue Mar 28 22:59:40 UTC 2017 : Endpoint response headers: {x-amzn-RequestId=39398a3e-140a-11e7-92a3-3fdc0fbb61c2, Connection=keep-alive, Content-Length=130, Date=Tue, 28 Mar 2017 22:59:39 GMT}
    Tue Mar 28 22:59:40 UTC 2017 : Execution failed due to configuration error: Malformed Lambda proxy response
    Tue Mar 28 22:59:40 UTC 2017 : Method completed with status: 502</p>
  </blockquote>
  
  <p>The fact that this ends up reading <code>Malformed Lambda proxy response</code> is not the issue - I have proven it by re-selecting the lambda function manually, letting the permissions be applied, retest immediately and all works fine, the Lambda is not even getting invoked.</p>