Is IAM Authentication to API Gateway via Cloudfront possible?

Question

Is it possible to use IAM Roles Authentication to an API Gateway endpoint via Cloudfront?

Here is a basic use case:

• /api -> API Gateway
• /* -> S3 HTML/Javascript

I've been able to get this working without Authentication similar to the following setup: https://www.codeengine.com/articles/process-form-aws-api-gateway-lambda/

How do you add CloudFront in front of API Gateway

Of particular note is to NOT forward the HOST header from Cloudfront...

When I enable IAM Authentication in the API, I receive the following response:

OPTIONS: 200

POST: 403

{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n'POST\n/test/create\n\naccept:application/json\ncontent-type:application/json\nhost:*****.execute-api.ap-****-2.amazonaws.com\nx-amz-date:20170328T044253Z\n\naccept;content-type;host;x-amz-date\na57656a9def890d9de2b637789f7e5917f4b2823765ae0122087d08f89a97380'\n\nThe String-to-Sign should have been\n'AWS4-HMAC-SHA256\n20170328T044253Z\n20170328/ap-southeast-2/execute-api/aws4_request\ncae7fd6b4cabd593ad2ec6ce7091c94dc8cba306e81da95d567873eea8f981a5'\n"}

The host in the Canonical String is that of the API Gateway...

Answer 1

As noted in comments, you'll run into difficulties due to the change of the HOST header. In theory signing the request with the API Gateway exceute-api domain as the value of HOST in theory should work, assuming CloudFront is not changing the payload in any other way.