title: AWS API Gateway 403 Forbidden when calling from Lambda
body: <p>I have an API Gateway endpoint with IAM authentication, no Custom Domain Names, no API Key, API is deployed to Prod and no AWS WAF enabled (TBMK) and VPC proxy integration request method.</p>
  
  <p>I am calling this endpoint from a Lambda (with attached <code>execute-api:Invoke</code> permission to call the API), however I am getting a 403 error with message <code>Forbidden</code>. <strong>Notice that if I remove the IAM authentication method, the call from Lambda works fine</strong>.</p>
  
  <p>I've already seen <a href="https://stackoverflow.com/questions/50607864/aws-api-gateway-403-forbidden">this</a> and <a href="https://stackoverflow.com/questions/40988051/getting-message-forbidden-reply-from-aws-api-gateway">this</a> SO questions + <a href="https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-troubleshoot-403-forbidden/" rel="nofollow noreferrer">AWS Doc on the topic</a> but I've already tried these solutions (as explained before).</p>
  
  <p>Sample code for calling API Gateway inside Lambda:</p>
  
  <pre><code>final HttpURLConnection connection = (HttpURLConnection) new URL(postApiUrl).openConnection();
  connection.setRequestMethod("POST");
  final int responseCode = connection.getResponseCode();
  //...
  </code></pre>
  
  <p>How I attach API Gateway ARN to Lambda role in CDK:</p>
  
  <pre><code>this.addToRolePolicy(
        new PolicyStatement({
            actions: [execute-api:Invoke],
            effect: Effect.ALLOW,
            resources: [postMethod.methodArn],
        }),
  );
  </code></pre>