title: aws cloudfront api endpoint responding with Forbidden(403)
body: <p>I have a lambda function behind an api gateway. This is working fine when triggered with an <strong>Invoke URL</strong>. Invoke URL is the link offered in method tab under stages.</p>
  
  <p><a href="https://i.stack.imgur.com/21YcR.png" rel="noreferrer"><img src="https://i.stack.imgur.com/21YcR.png" alt="enter image description here"></a></p>
  
  <p>I am sending request to the resource as below, and this works fine.
  <a href="https://i.stack.imgur.com/5om4Y.png" rel="noreferrer"><img src="https://i.stack.imgur.com/5om4Y.png" alt="enter image description here"></a></p>
  
  <p>I want to set a custom domain for my api so I followed the standard procedure to set an ACM certificate. In addition to that I did set domain (api.tarkshala.com) in route53. Check screenshots given below.</p>
  
  <p>ACM certificate imported
  <a href="https://i.stack.imgur.com/x5EU1.png" rel="noreferrer"><img src="https://i.stack.imgur.com/x5EU1.png" alt="enter image description here"></a></p>
  
  <p>Custom domain mapping
  <a href="https://i.stack.imgur.com/WEOYo.png" rel="noreferrer"><img src="https://i.stack.imgur.com/WEOYo.png" alt="enter image description here"></a></p>
  
  <p>Domain name mapped in route53
  <a href="https://i.stack.imgur.com/DpCtB.png" rel="noreferrer"><img src="https://i.stack.imgur.com/DpCtB.png" alt="enter image description here"></a></p>
  
  <p>But when I hit the API using cloudfront link(d3pn2j4magp6tp.cloudfront.net) or the domain name (api.tarkshala.com) using POSTMAN, it ends up into <strong>403 Forbidden</strong>.</p>
  
  <p>I don't know what exactly am I missing?</p>
  
  <p>Response Header looks as following:</p>
  
  <pre><code>Connection →keep-alive
  Content-Length →23
  Content-Type →application/json
  Date →Fri, 13 Apr 2018 03:17:25 GMT
  Via →1.1 a1cf0e6cf29b584b5fe1ada9ccee9758.cloudfront.net (CloudFront)
  X-Amz-Cf-Id →9Jh5HeQIuDNfm5WGlTae34oYZ7BiN3nI2VlH_8PJHLQ0mr2C20njJQ==
  X-Cache →Error from cloudfront
  x-amz-apigw-id →FQoiyF1phcwFVrg=
  x-amzn-ErrorType →ForbiddenException
  x-amzn-RequestId →3013c239-3ec9-11e8-abe6-53449bcfc96c
  </code></pre>
  
  <p>Response:</p>
  
  <pre><code>{
      "message": "Forbidden"
  }
  </code></pre>