x-api-key in header still gives Forbidden response (AWS lambda function)

Question

I have a Lambda function on AWS for which I have created a trigger with Security. I set the url ( $url ) to be the API endpoint listed in the "triggers" section of the lambda function, and the x-api-key (instead of my_api_key below) to be the one listed in the trigger "API key".

However, if I try to make a simple call to the lambda function like so:

           $url = "https://abcd1234.execute-api.us-east-2.amazonaws.com/default/lambda_function_name";

           $header = array(
               "Content-Type" => "application/json",
               "Accept" => "application/json",
               "x-api-key" => "my_api_key",
           );
           
           $data = array(
             "email_address" => $_POST['email'],
           );
           
           $curl = curl_init();
           curl_setopt($curl, CURLOPT_POST, 1);
           curl_setopt($curl, CURLOPT_URL, $url);
           curl_setopt($curl, CURLOPT_HTTPHEADER, json_encode($header));
           curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode($data));

           $result = curl_exec($curl);
           curl_close($curl);

I obtain the response "Forbidden".

What is the issue here? Is there some AWS configuration I need to change? Or is the syntax or place to add the x-api-key wrong?

Thanks in advance!

Maithreya

Answer 1

I am assuming you are connecting to AWS API Gateway. Your endpoint URL must include the stage and resource, ie:

https://abcd1234.execute-api.us-west-2.amazonaws.com/prod/send_email_alert

Calling the API gateway base endpoint URL will result in this error.