How to construct AWS CloudFormation integration URI for AWS ApiGateway integration with S3, SQS, SNS, DynamoDB and other services?

Question

Is there some place with samples on how to make a bunch of actions through ApiGateway integration? Looking how to upload object to S3, push item to SQS & SNS queues, make DynamoDB call and many other things, trying to find documentation on how to construct those paths.

I'm using CloudFormation template, which uses integration URI to setup this AWS ApiGateway integration with AWS services.

Can't find documentation talking how to make these URI paths for all kind of services.

Answer 1

When setting up the integration request with another AWS service action, the integration request URI is also an ARN.

For example, for the integration with the GetBucket action of Amazon S3, the integration request URI is an ARN of the following format:

arn:aws:apigateway:api-region:s3:path

See more: https://docs.aws.amazon.com/apigateway/latest/developerguide/integration-request-basic-setup.html

Dynamodb: A bit more complicated then S3: https://aws.amazon.com/blogs/compute/using-amazon-api-gateway-as-a-proxy-for-dynamodb/

SNS: https://aws.amazon.com/premiumsupport/knowledge-center/api-gateway-proxy-integrate-service/

For SQS I have found cloudformation setup:

PostMethod:
    Type: "AWS::ApiGateway::Method"
    Properties:
      AuthorizationType: "NONE"
      ApiKeyRequired: "true"
      HttpMethod: "POST"
      ResourceId: !Ref "SomeResource"
      RestApiId: !Ref "RestApi"
      MethodResponses:
      - StatusCode: 200
      Integration:
        Credentials: !GetAtt "RestApiRole.Arn"
        IntegrationHttpMethod: "POST"
        IntegrationResponses:
        - StatusCode: 200
        Type: "AWS"
        Uri: !Sub "arn:aws:apigateway:${AWS::Region}:sqs:action/SendMessage"
        RequestParameters:
          integration.request.querystring.QueueUrl: !Sub "'${SomeQueue}'"
          integration.request.querystring.MessageBody: "method.request.body"

and here the code for RestApiRole:

RestApiRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Action:
          - "sts:AssumeRole"
          Principal:
            Service:
            - "apigateway.amazonaws.com"
          Effect: "Allow"
      Policies:
      - PolicyName: "InvokeLambda"
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Action:
            - "lambda:InvokeFunction"
            Resource: !GetAtt "LambdaFunction.Arn"
            Effect: "Allow"

Answer 2

From Uri property documentation:

If you specify AWS for the Type property, specify an AWS service that follows this form: arn:aws:apigateway:region:subdomain.service|service:path|action/service_api. For example, a Lambda function URI follows this form: arn:aws:apigateway:region:lambda:path/path. The path is usually in the form /2015-03-31/functions/LambdaFunctionARN/invocations. For more information, see the uri property of the Integration resource in the Amazon API Gateway REST API Reference.

More descriptions and samples from another AWS documentation:

From these documentation samples & descriptions it seems there are 2 type of APIs - action based and path based.

Using Action based API 😍

I think most, if not all support this. While those actions are available in IAM settings and all API documentations, while all AWS services are web services, aka they have API interfaces and those interfaces use Actions. Correct me if that's wrong for some service, but I think by following this structure should be possible to make any call to any service which has integration with API Gateway service.

Sometimes need to use path API 😭

Was trying to upload file to S3 with PutObject and it was giving error:

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>MethodNotAllowed</Code>
    <Message>The specified method is not allowed against this resource.</Message>
    <Method>PUT</Method>
    <ResourceType>SERVICE</ResourceType>
    <RequestId>....</RequestId>
    <HostId>....=</HostId>
</Error>

Replaced with path API format and it worked out. So the learning here is I will continue to try using action APIs first and if can't for that specific action - switch to path API while I feel Action API is more declarative.

Sample structure Action API:

arn:aws:apigateway:us-east-1:SERVICE_NAME:action/ACTION_NAME&Var1=Value1&Var2=Value2

Sample call to S3 service. Action name - GetObject. Documentation for this API Actions says there are 2 required properties - Bucket (bucket name) and Key. So full sample URI:

arn:aws:apigateway:us-east-1:s3:action/GetObject&Bucket=myDemoBucket1&Key=some/path/to/file

Same thing with path API:

arn:aws:apigateway:us-east-1:s3:path/myDemoBucket1/some/path/to/file

---

I found one way to get samples. Use console UI, make the endpoint, deploy to some stage and go to stage, select Export tab, and export as Swagger + API Gateway Extensions in Yaml format. While i use Yaml with cloudformation. Inside that Yaml there are all you need. If there are no "Stages", go to "Resources" and from dropdown select deploy and create Stage inside dialog.

---

Here are some different samples I was able to find for main services:

Invoke Lambda docs:

arn:aws:apigateway:api-region:lambda:path//2015-03-31/functions/arn:aws:lambda:lambda-region:account-id:function:lambda-function-name/invocations

The path part seems to map to API action from API docs:

DynamoDB blog post

You need to use HTTP method by API Action documentation + Api Action name + IntegrationRequest template to call DynamoDB.

Sample URI for Query action:

arn:aws:apigateway:us-east-1:dynamodb:action/Query

SNS blog post

Sample URI: arn:aws:apigateway:region:sns:action/Publish With region: arn:aws:apigateway:us-east-1:sns:action/Publish

You need to pass in TopicArn and Message and other parameters through URL Query String Parameters. There is good thread on the topic: https://stackoverflow.com/a/64268791/1737158

https://docs.aws.amazon.com/sns/latest/api/API_Publish.html#API_Publish_Examples