Posting SNS message to HTTPS Api Gateway endpoint to trigger Lambda function

Question

I want to trigger a Lambda function in Account2, region2 from Account1, region1 .

So, I use an SNS topic subscribed to an HTTPS API Gateway endpoint (POST method), which will trigger the Lambda.

The problem is that I do not know how to grab the SNS POST request arriving at the API Gateway endpoint .

I am trying to follow this guide from the AWS docs.

I have successfully test the connection between Gateway and Lambda. I use this dummy JSON:

{
  "type": "object",
  "description": "A subscription confirmation message",
  "properties": {
    "SignatureVersion": {
      "enum": [
        "1"
      ],
      "type": "string"
    },
    "Timestamp": {
      "type": "string"
    },
    "MessageId": {
      "type": "string",
      "identity": true
    },
    "SubscribeURL": {
      "type": "string"
    },
    "Token": {
      "type": "string"
    },
    "Signature": {
      "type": "string"
    },
    "Message": {
      "minLength": 1,
      "type": "string",
      "maxLength": 4096
    },
    "Type": {
      "enum": [
        "SubscriptionConfirmation"
      ],
      "type": "string"
    },
    "TopicArn": {
      "type": "string",
      "maxLength": 1224
    }
  }
}

And the test Lambda I use is this:

import boto3,json

def handler(event, context):

    #return event['properties']['SubscribeURL']
    return event

The docs state here that After you subscribe an HTTP/HTTPS endpoint, Amazon SNS sends a subscription confirmation message to the HTTP/HTTPS endpoint.

I don't necessarily want to have a piece of code to confirm the subscription every time because I will only set the flow once. But, I somehow need to take the subscription URL in order to confirm the subscription.

Any pointers would be helpful!

Answer 1

What problem are you trying to solve specifically? You should be able to invoke a Lambda function across accounts using temporary credentials . You could also publish to an SNS topic directly from your Lambda function , so you probably don't need API Gateway.