serverless-stack-com 🚀 - Comments: Test the APIs

Can you give us example screen shots to test API with postman using AWS signature? thanks in advance

yashg5 on 20 Jul 2017

👍1

@yashg5 I'm not too familiar with using Postman. Perhaps somebody else can give it a try.

jayair on 20 Jul 2017

First off, thanks a ton for your tutorials. I went through the previous and now the revised. You're doing great work.

For some reason I'm getting an error when testing the apis:

Error: Invalid UserPoolId format.

at new CognitoUserPool (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\amazon-cognito-identity-js\lib\CognitoUserPool.js:56:13)
at authenticate (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\index.js:70:18)
at Object.<anonymous> (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\index.js:155:1)

I can't really think of a reason why I would be experiencing this problem. I've had no problems for any of the tests I've done so far that used the same user-pool-id.

Any chance you could provide a sample apig-test call with actual values?

marshallbunch on 20 Jul 2017

@marshallbunch Here is a sample one that I was using. I altered some of the values around but the format should be like so.

apig-test \
--username='[email protected]' \
--password='Passw0rd!' \
--user-pool-id='us-east-1_YBhdXYvix' \
--app-client-id='29qwoeorti0ctjkur5h91lkw5g' \
--cognito-region='us-east-1' \
--identity-pool-id='us-east-1:565cc505-5486-4278-bf0f-9736p9apq8m5' \
--invoke-url='https://w5z1hluqmp5.execute-api.us-east-1.amazonaws.com/test' \
--api-gateway-region='us-east-1' \
--path-template='/notes' \
--method='POST' \
--body='{"content":"hello world","attachment":"hello.jpg"}'

jayair on 20 Jul 2017

👍1

No cigar. Won't make it past the user-pool-id.

marshallbunch on 20 Jul 2017

@marshallbunch Hmm can I see the complete output from the command?

jayair on 20 Jul 2017

Sure:

C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\amazon-cognito-identity-js\lib\CognitoUserPool.js:56
      throw new Error('Invalid UserPoolId format.');
      ^

Error: Invalid UserPoolId format.
    at new CognitoUserPool (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\amazon-cognito-identity-js\lib\CognitoUserPool.js:56:13)
    at authenticate (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\index.js:70:18)
    at Object.<anonymous> (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\index.js:155:1)
    at Module._compile (module.js:571:32)
    at Object.Module._extensions..js (module.js:580:10)
    at Module.load (module.js:488:32)
    at tryModuleLoad (module.js:447:12)
    at Function.Module._load (module.js:439:3)
    at Module.runMain (module.js:605:10)
    at run (bootstrap_node.js:427:7)

marshallbunch on 20 Jul 2017

For beginners it might be helpful to specify that YOUR_API_GATEWAY_URL should include the stage-name (prod in the example).

"https://ly55wbovq4.execute-api.us-east-1.amazonaws.com/prod"

manubhat90 on 20 Jul 2017

👍3

did that as well.

marshallbunch on 20 Jul 2017

@marshallbunch Can you show me the full command you used as well? I'm not too familiar with the shell in Windows but let's take a look.

@manubhat90 Good catch. It would work either way but that can be confusing.

jayair on 20 Jul 2017

@jayair It is most definitely a syntax problem for the shell in windows. I got past the "invalid UserPoolId" error by getting rid of all the \ and the = and '. The current error is that it doens't like the json in the body content.

apig-test --username [email protected] --password Passw0rd! --user-pool-id us-east-1_HwIVtcRh2 --app-client-id 34bb7b87t6rtc387foiletrldf --cognito-region us-east-1 --identity-pool-id us-east-1:285f61b7-8a95-4596-90ce-7f7e1848c2ed --invoke-url https://6xosj8ww6h.execute-api.us-east-1.amazonaws.com/prod/words --api-gateway-region us-east-1' --path-template /words' --method POST --body {"content":"hello world","attachment":"hello.jpg"}
Authenticating with User Pool
Getting temporary credentials
Making API request
C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\request.js:31
            throw err;
            ^

SyntaxError: Unexpected token c in JSON at position 1
    at JSON.parse (<anonymous>)
    at makeRequest (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\index.js:131:19)
    at C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\index.js:114:5
    at C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\credentials.js:123:23
    at Response.<anonymous> (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\credentials\cognito_identity_credentials.js:258:7)
    at Request.<anonymous> (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\request.js:364:18)
    at Request.callListeners (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\sequential_executor.js:105:20)
    at Request.emit (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\sequential_executor.js:77:10)
    at Request.emit (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\request.js:683:14)
    at Request.transition (C:\Users\proet\AppData\Roaming\npm\node_modules\aws-api-gateway-cli-test\node_modules\aws-sdk\lib\request.js:22:10)

marshallbunch on 20 Jul 2017

👍4

@marshallbunch Yeah I think we need to figure out how to format a string as an argument in the command line. And possibly escape the characters properly.

jayair on 20 Jul 2017

👍1

Hey guys. Great walkthrough. Everything went smoothly until it was time to test the API. I'm getting 502 bad gateway back from API Gateway. I looked in the CloudWatch logs and found that it can't import modules.

Unable to import module 'create': Error
at Function.Module._resolveFilename (module.js:469:15)
at Function.Module._load (module.js:417:25)
at Module.require (module.js:497:17)
at require (internal/module.js:20:19)
at Object.<anonymous> (/var/task/create.js:76:18)
at __webpack_require__ (/var/task/create.js:20:30)
at Object.<anonymous> (/var/task/create.js:171:20)

I dug into this more by running the get lambda from the API gateway console dashboard using the test command. I got this:

Endpoint response body before transformations: 
{
  "errorMessage": "Cannot find module 'babel-runtime/regenerator'",
  "errorType": "Error",
  "stackTrace": [
    "require (internal/module.js:20:19)", 
    "Object.<anonymous> (/var/task/list.js:76:18)", 
    "__webpack_require__ (/var/task/list.js:20:30)", 
    "Object.<anonymous> (/var/task/list.js:176:20)", 
    "__webpack_require__ (/var/task/list.js:20:30)", 
    "/var/task/list.js:63:18", 
    "Object.<anonymous> (/var/task/list.js:66:10)"
  ]
}

This led me to look into the file being uploaded to S3 by serverless deploy and found that they didn't include webpack. I've attached a screenshot of the unzipped file sent to S3 and the files built by using serverless webpack. As you can see, the node_modules folder is very different between them.

screenshot 2017-07-21 15 41 29

Some of the results of serverless deploy:

$ serverless deploy
Serverless: Bundling with Webpack...
Time: 1698ms
     Asset     Size  Chunks             Chunk Names
 create.js  7.54 kB       0  [emitted]  create
 update.js  7.41 kB       1  [emitted]  update
   list.js  7.11 kB       2  [emitted]  list
    get.js  7.06 kB       3  [emitted]  get
 delete.js  6.84 kB       4  [emitted]  delete
handler.js  3.35 kB       5  [emitted]  handler
   [0] external "babel-runtime/core-js/json/stringify" 42 bytes {0} {1} {2} {3} {4} {5} [not cacheable]
   [1] external "babel-runtime/regenerator" 42 bytes {0} {1} {2} {3} {4} [not cacheable]
   [2] external "babel-runtime/helpers/asyncToGenerator" 42 bytes {0} {1} {2} {3} {4} [not cacheable]
   [3] ./lib/dynamodb-lib.js 652 bytes {0} {1} {2} {3} {4} [built]
   [4] external "aws-sdk" 42 bytes {0} {1} {2} {3} {4} [not cacheable]
   [5] ./lib/response-lib.js 721 bytes {0} {1} {2} {3} {4} [built]
   [6] ./create.js 2.99 kB {0} [built]
   [7] external "uuid" 42 bytes {0} [not cacheable]
   [8] ./delete.js 2.37 kB {4} [built]
   [9] ./get.js 2.58 kB {3} [built]
  [10] ./handler.js 696 bytes {5} [built]
  [11] ./list.js 2.61 kB {2} [built]
  [12] ./update.js 2.9 kB {1} [built]
Serverless: Packing external modules: [email protected], [email protected]
Serverless: Packaging service...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Uploading service .zip file to S3 (14.28 KB)...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
......................................
Serverless: Stack update finished...
Service Information
service: notes-app-api
stage: prod
region: us-west-2
api keys:
  None
endpoints:
  ---
functions:
  create: notes-app-api-prod-create
  list: notes-app-api-prod-list
  get: notes-app-api-prod-get
  update: notes-app-api-prod-update
  delete: notes-app-api-prod-delete

Any help would be very much appreciated.

tsdorsey on 22 Jul 2017

@tsdorsey Thanks for the details. As a quick sanity check, can I see your package.json and serverless.yml?

jayair on 22 Jul 2017

@jayair I should have done this before I posted.
https://github.com/tsdorsey/sls-notes-app

I have serverless-dynamodb-local and serverless-offline in my package file but I'm not using them at the moment. I planned to do that later.

tsdorsey on 22 Jul 2017

@tsdorsey Good catch. It appears I'm experiencing the same issue.

marshallbunch on 22 Jul 2017

@marshallbunch and @jayair I'm newish to webpack. Do you think you could point me in a direction so I could try to help figure this out? Got any gut feelings?

tsdorsey on 22 Jul 2017

Ok, so I watched the folders as I ran serverless package and the .webpack folder is created with the dependencies in the node_modules folder as expected. Then the zip file is made and the .webpack folder is cleaned up. I have been reading through the package plugin; I'm suspect of the excludes directive but the aren't logged... :(

tsdorsey on 22 Jul 2017

Getting 403 response

Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'Forbidden' } }

navinkumarr on 22 Jul 2017

👍2

Yeah I get the same response...

{ status: 403,
  statusText: 'Forbidden',
  data: { Message: 'User: arn:aws:sts::907468717626:assumed-role/Cognito_notesidentitypoolAuth_Role/CognitoIdentityCredentials is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-2:********7626:ux5xagukr9/prod/POST/notes' } }

I guess we forgot some tweaks that are not in the code, but rather in the aws console.

Jonarod on 22 Jul 2017

👍3

Ok, I got it working.
Basically, I deleted my Federated Identity Pool and recreated it from scratch following this section:

http://serverless-stack.com/chapters/create-a-cognito-identity-pool.html

Note that after doing so, I got these messes:

My Authenticated rule was already existing, so AWS would not let me change it. To change it, you have to head over your IAM service, within the "Roles" section. Here, look for your existing rule and edit it to be like in the tutorial.
My Authenticated rule was still restricting to old Federated Identity Pool. You can fix that in the "Trust Relationships" tab of the same "Roles" section of the IAM service. You should press "Edit relationships" and replace your old Identity pool ID with the new one.

After that, I got correct 200 status.

Hope it helps

Jonarod on 22 Jul 2017

👍3

I'm not able to clear this test - if I put in all of my information in as a string, I get the cmd line response:
'Authenticating with User Pool
User does not exist'

Which makes no sense, because the user definitely exists - I created one with the same default credentials as in the example and a seperate one, which I used to create, update, delete the event.json file throughout the tutorial.

When I remove all the semi-colons from the data, it runs through saying:
'Authenticating with User Pool'
Getting temporary credential
Making API request

And then gives me the same JSON token error as the other commenter upstairs!

When I try just taking the string out the username and password, and keeping the rest of the strings there (and some variations) I get this error message:
Authenticating with UserPool
Getting temporary credentials
Inaccessible host: cognito-identity.xn--us-east-2-499dua.amazonaws.com'. This service may not be available in the‘us-east-2’' region.

However, from looking at AWS documentation, Cognito Identity should be available in US-East-2... Halp!

mikhael28 on 22 Jul 2017

@tsdorsey I just tried your repo and I got it to deploy and call it fine. Of course the call failed because I don't have the IAM roles set up properly to do this. But It's calling everything fine.

screen shot 2017-07-22 at 3 03 29 pm
screen shot 2017-07-22 at 3 04 29 pm

I suspect there is something going on on your local. Can you try the following and check the versions you are running?

screen shot 2017-07-22 at 3 05 42 pm

jayair on 22 Jul 2017

@marshallbunch Are you seeing the same error as @tsdorsey? If you go into your CloudWatch logs do you see the same error (Unable to import module 'create': Error)?

jayair on 22 Jul 2017

@Jonarod Yeah that error sounds like the IAM Role was not set properly. Thanks for reporting back with detail. I'm sure it'll help folks that run into something similar.

jayair on 22 Jul 2017

@navinkumarr Your issue sounds like the issue @Jonarod ran into. You can check if the IAM Role has been set properly by going to your AWS Console > IAM > Roles (in the sidebar) > Cognito_notesidentitypoolAuth_Role > Scroll down and click on Show Policy.

screen shot 2017-07-22 at 3 14 54 pm

And make sure the policy looks like the one in the tutorial.

jayair on 22 Jul 2017

👍3

@mikhaelbendavid Are you on Windows as well like @marshallbunch? Can I see the full command you used that generated that last error?

jayair on 22 Jul 2017

@jayair I'm getting

{ status: 502,
  statusText: 'Bad Gateway',
  data: { message: 'Internal server error' } }

Digging deeper into Cloudwatch, specifically the create lambda function, I get

Unable to import module 'create': Error
at Function.Module._resolveFilename (module.js:469:15)
at Function.Module._load (module.js:417:25)
at Module.require (module.js:497:17)
at require (internal/module.js:20:19)
at Object.<anonymous> (/var/task/create.js:76:18)
at __webpack_require__ (/var/task/create.js:20:30)
at Object.<anonymous> (/var/task/create.js:167:20)
at __webpack_require__ (/var/task/create.js:20:30)
at /var/task/create.js:63:18
at Object.<anonymous> (/var/task/create.js:66:10)

My package.json is:

{
  "name": "notes-app-api",
  "version": "1.0.0",
  "description": "",
  "main": "handler.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "devDependencies": {
    "babel-core": "^6.25.0",
    "babel-loader": "^7.1.1",
    "babel-plugin-transform-runtime": "^6.23.0",
    "babel-preset-es2015": "^6.24.1",
    "babel-preset-stage-3": "^6.24.1",
    "glob": "^7.1.2",
    "serverless-webpack": "^2.0.0",
    "webpack": "^3.3.0",
    "webpack-node-externals": "^1.6.0"
  },
  "dependencies": {
    "babel-runtime": "^6.23.0"
  }
}

I haven't done any digging into the packaging that serverless deploy produces but this is to confirm I'm experiencing the same issue as @tsdorsey is experiencing.

thesavvygreek on 23 Jul 2017

@thesavvygreek Can I see what version of Node, NPM, and Serverless you are using?

jayair on 23 Jul 2017

@jayair Sure

node -v 8.1.4
npm -v 5.0.3
serverless -v 1.18.0

thesavvygreek on 23 Jul 2017

@thesavvygreek @tsdorsey Thanks for that. Figured it out!

It's a Serverless Framework bug. They broke it with their latest release. Here is the issue somebody else opened for it - https://github.com/serverless/serverless/issues/3972

For now you can use 1.17.0 by doing the following. I'll add this to the tutorial.

$ npm uninstall -g serverless
$ npm install -g [email protected]

And then serverless deploy again.

jayair on 23 Jul 2017

👍6 🎉2

@thesavvygreek Btw, your package.json is missing this line for some reason - https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/package.json#L34

jayair on 23 Jul 2017

@jayair Ah nice one, it works! Thanks for the help!

thesavvygreek on 23 Jul 2017

🎉1

I'm running into a 403 as well. I tried @Jonarod 's approach and carefully recreated the pool, but no dice.
I get this in the terminal:
Authenticating with User Pool Getting temporary credentials Making API request { status: 403, statusText: 'Forbidden', data: { message: 'Forbidden' } }

bradodarb on 23 Jul 2017

@jayair thank you so much for the thorough and quick help.
@marshallbunch did you get things squared away using this info?

I had a moment of horror when I moved to [email protected] and it still failed. Then I got to thinking about it and realized that I was using an environment variable for the region in my dynamodb-lib file. When I hard coded that to be us-west-2 The test came back successful. I know aws-lambda can do environment variables but I'll sort that out later.

For posterities sake I was running the following versions:
node -v 8.1.3
npm -v 5.0.3
serverless -v 1.18.0

tsdorsey on 23 Jul 2017

👍1

@bradodarb Can you take a look at your Cloudwatch logs to see what it says? Also, can you post the IAM policy that you have (follow these instructions https://github.com/AnomalyInnovations/serverless-stack-com/issues/112#issuecomment-317204545)?

jayair on 24 Jul 2017

Thanks for taking a look, @jayair.

I enabled logging on the API stage but see nothing in cloudwatch.

I did triple check my setting as you suggested and confirm that I have this inline role:

    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "cognito-identity:*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::m4-user-assets/${cognito-identity.amazonaws.com:sub}*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "execute-api:Invoke"
            ],
            "Resource": [
                "arn:aws:execute-api:us-east-1:*:ps8mmgaj2c/*"
            ]
        }
      ]
  }

bradodarb on 24 Jul 2017

I tried switching the test parameters up a bit and instead of breaking the test url up between invoke-url and path-template as in the example I used the invoke-uRL from the API Gateway console and set the template to '/'

So instead of this:

apig-test \
--username='[email protected]' \
--password='Passw0rd!' \
--user-pool-id='us-east-1_***********' \
--app-client-id='*************************' \
--cognito-region='us-east-1' \
--identity-pool-id='us-east-1:******************************************' \
--invoke-url='https://ps8mmgaj2c.execute-api.us-east-1.amazonaws.com/dev' \
--api-gateway-region='us-east-1' \
--path-template='/mail' \
--method='POST' \
--body='{"content":"hello world","attachment":"hello.jpg"}

I tried this:

apig-test \
--username='[email protected]' \
--password='Passw0rd!' \
--user-pool-id='us-east-1_***********' \
--app-client-id='*************************' \
--cognito-region='us-east-1' \
--identity-pool-id='us-east-1:******************************************' \
--invoke-url='https://ps8mmgaj2c.execute-api.us-east-1.amazonaws.com/dev/mail' \
--api-gateway-region='us-east-1' \
--path-template='/' \
--method='POST' \
--body='{"content":"hello world","attachment":"hello.jpg"}

And I seemed to get more information back:

Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical
 String for this request should have been\n\'POST\n/dev/mailC%3A/Program%2520Files/Git/\n\naccept:application/json\ncontent-type:application/json\nhost:ps8mmgaj2c.execute-api.us-east-1.amazonaws.com\nx-amz-date:2017
0724T154352Z\n\naccept;content-type;host;x-amz-date\n3a99f7c41ea871222ce9eb05cc8c7a5bbfc8e141bbb3c3999cff381d1462d448\'\n\nThe String-to-Sign should have been\n\'AWS4-HMAC-SHA256\n20170724T154352Z\n20170724/us-east-
1/execute-api/aws4_request\nb85c01d15750e6db44ea387c0ac4dec6bfd39b6cd8a245e32141e97b82955917\'\n' } }

This prompted me to have a look at all settings in the test parameters and everything validated to be using the correct variables.

bradodarb on 24 Jul 2017

@bradodarb The IAM Policy looks good. Can you post your serverless.yml as well? Let's make sure things look okay.

jayair on 24 Jul 2017

@jayair , I'm sure I'm doing/not doing something silly as I'm pretty novice with aws still. I really appreciate your help.

service: m4-user-mail-api

# Use serverless-webpack plugin to transpile ES6/ES7
plugins:
  - serverless-webpack

# Enable auto-packing of external modules
custom:
  webpackIncludeModules: true

provider:
  name: aws
  runtime: nodejs6.10
  stage: dev
  region: us-east-1

  # 'iamRoleStatement' defines the permission policy for the Lambda function.
  # In this case Lambda functions are granted with permissions to access DynamoDB.
  iamRoleStatements:
    - Effect: Allow
      Action:
        - dynamodb:DescribeTable
        - dynamodb:Query
        - dynamodb:Scan
        - dynamodb:GetItem
        - dynamodb:PutItem
        - dynamodb:UpdateItem
        - dynamodb:DeleteItem
      Resource: "arn:aws:dynamodb:us-east-1:*:*"

functions:
  # Defines an HTTP API endpoint that calls the main function in create.js
  # - path: url path is /mail
  # - method: POST request
  # - cors: enabled CORS (Cross-Origin Resource Sharing) for browser cross
  #     domain api call
  # - authorizer: authenticate using the AWS IAM role
  create:
    handler: create.main
    events:
      - http:
          path: mail
          method: post
          cors: true
          authorizer: aws_iam
  get:
    # Defines an HTTP API endpoint that calls the main function in get.js
    # - path: url path is /mail/{id}
    # - method: GET request
    handler: get.main
    events:
      - http:
          path: mail/{id}
          method: get
          cors: true
          authorizer: aws_iam
  list:
    # Defines an HTTP API endpoint that calls the main function in list.js
    # - path: url path is /notes
    # - method: GET request
    handler: list.main
    events:
      - http:
          path: mail
          method: get
          cors: true
          authorizer: aws_iam
  update:
    # Defines an HTTP API endpoint that calls the main function in update.js
    # - path: url path is /mail/{id}
    # - method: PUT request
    handler: update.main
    events:
      - http:
          path: mail/{id}
          method: put
          cors: true
          authorizer: aws_iam
  delete:
    # Defines an HTTP API endpoint that calls the main function in delete.js
    # - path: url path is /mail/{id}
    # - method: DELETE request
    handler: delete.main
    events:
      - http:
          path: mail/{id}
          method: delete
          cors: true
          authorizer: aws_iam

bradodarb on 24 Jul 2017

The tutorial is great and must have already saved many 1,000s of person hours - thank you.

Unfortunately I have the same issue as @bradodarb. Always get a 404 when using apig-test. Have tried carefully recreating the identity pool. Pretty sure my IAM role/policy is correct. Must be something simple!

jugglingcats on 24 Jul 2017

@bradodarb That looks good as well. The only thing I can do now is try out your code. Can you put it up on GitHub like @tsdorsey had done?

@jugglingcats Thanks for the kind words. The 404 seems like a different issue. Can I see the full output for the apig-test command?

jayair on 24 Jul 2017

Sorry I meant 403 Forbidden...

jugglingcats on 24 Jul 2017

Same issue as @bradodarb @jugglingcats

Can we turn on cloudwatch for API gateway?
Is the 403 being returned by the API gateway or the lambda function?
When the IAM policy gets updated - do the permission changes reflect immediately?
Looks like there's a policy simulator located here - the policy seems to work when accessing the API gateway endpoint for the POST method but still get the 403 when using apig-test. Here's my output:

Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'Forbidden' } }

neowulf on 25 Jul 2017

👍1

@neowulf33 Thanks for the details.

Yeah you can turn on CloudWatch for API Gateway from the console under API Gateway. But it does not log some auth related errors. So I'm suspecting this is happening before it hits Lambda. The permission changes are not immediate but relatively quick. I'd say a couple of minutes.

Can you put up your repo? I want to try it out myself and see whats going on.

jayair on 25 Jul 2017

I'm getting an unauthorized response from this test and I'm not sure why. Anyone else get this, too?
{ status: 401, statusText: 'Unauthorized', data: { message: 'Unauthorized' } }

limifont on 25 Jul 2017

@jayair

Here's my repo:
https://github.com/bradodarb/m4-user-mail-api

bradodarb on 25 Jul 2017

@jayair Hi, Jayair. I'm preparing my tech talk on AWS lambda and following your tutorial. This is really helpful. Thank you so much.
I deployed the API ok. but testing API keeps giving me this error.

{ status: 500,
statusText: 'Internal Server Error',
data: { status: false } }

In cloudWatch logs it says

message: 'User: arn:aws:sts::721932120760:assumed-role/notes-app-api-prod-us-east-2-lambdaRole/notes-app-api-prod-create is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:us-east-2:721932120760:table/notes',
code: 'AccessDeniedException',
time: 2017-07-25T04:17:50.292Z,
requestId: '***********',
statusCode: 400,

my serverless.yml looks like this

service: notes-app-api # NOTE: update this with your service name

 Use serverless-webpack plugin to transpile ES6 / ES7
plugins:
  - serverless-webpack
 Enable auto-packing of external modules
custom:
  webpackIncludeModules: true

 You can pin your service to only deploy with a specific Serverless version
 Check out our docs for more details
 frameworkVersion: "=X.X.X"

provider:
  name: aws
  runtime: nodejs6.10
  stage: prod
  region: us-east-2

 you can add statements to the Lambda function's IAM Role here
 'iamRoleSTatement' defines the permission policy for the Lambda function .
 In this case Lambda functions are granted with permissions to access DynamoDB.
iamRoleStatements:
  - Effect: Allow
    Action:
      - dynamodb:DescribeTable
      - dynamodb:Query
      - dynamodb:Scan
      - dynamodb:GetItem
      - dynamodb:PutItem
      - dynamodb:UpdateItem
      - dynamodb:DeleteItem
    Resource: "arn:aws:dynamodb:us-east-2:*:*"

I guess I hadn't figured it correctly about some permissions here but I can't find the reason why.
do you have any idea about this problem?

deepseafishing on 25 Jul 2017

@jayair - Here is the full command:
Michaels-MacBook-Pro:serverlessblog Mikha-el$ apig-test \

--username=‘[email protected]’ \
--password='Passw0rd!' \
--user-pool-id='us-east-2_t6tTEb8QD' \
--app-client-id='52vsuvcodusl9lmeqcr4maq4ck' \
--cognito-region=‘us-east-2’ \
--identity-pool-id='us-east-2:a3fca15d-934a-4c40-915a-9a147e7010a4' \
--invoke-url='https://2mf1f9pxi7.execute-api.us-east-2.amazonaws.com/prod' \
--api-gateway-region=‘us-east-2’ \
--path-template='/notes' \
--method='POST' \
--body='{"content":"hello world","attachment":"hello.jpg"}'
Authenticating with User Pool
User does not exist.

My repo is here: https://github.com/mikhaelbendavid/serverlessblog

I'm on MacOS! I don't think there is anything wrong with my serverless.yml - I skipped ahead to the part where I am creating new notes to the API, and I am getting an issue that I have a TypeError: 'unable to fetch'

mikhael28 on 25 Jul 2017

Also getting the same error as @bradodarb, @jugglingcats, and @neowulf33

Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n\'POST\n/prod/notes\n\naccept:application/json\ncontent-type:application/json\nhost:1lu7ffc9hk.execute-api.us-west-2.amazonaws.com\nx-amz-date:20170725T140608Z\n\naccept;content-type;host;x-amz-date\n3a99f7c41ea871222ce9eb05cc8c7a5bbfc8e141bbb3c3999cff381d1462d448\'\n\nThe String-to-Sign should have been\n\'AWS4-HMAC-SHA256\n20170725T140608Z\n20170725/us-west-2/execute-api/aws4_request\nb672c9c637363a6d64ffdcdc78a2d76d7677b6cbf120411a8709a46ab27761e0\'\n' } }

Additional piece of info for me is that I was mid-way through the tutorial when the switch was made to use IAM as an authorizer. So I had to go back and make changes from looking at the PR. I wouldn't be at all surprised if I missed something.

jcowley on 25 Jul 2017

Okay, for me the signature issue was caused by having a trailing slash on the invoke-url, e.g.:

...
--invoke-url='https://ly55wbovq4.execute-api.us-east-1.amazonaws.com/prod/'
--path-template='/notes' \
...

The invoke url and path are combined by aws-api-gateway-cli-test and resulted in a double slash in the URL, which would (I guess) result in a different signature than the one AWS would expect for the request.

Removing the slash after prod fixed it for me:

...
--invoke-url='https://ly55wbovq4.execute-api.us-east-1.amazonaws.com/prod'
--path-template='/notes' \
...

So maybe double check your invoke-url and path-template.

jcowley on 25 Jul 2017

👍1

@bradodarb Just tried your repo. It worked fine for me.

screen shot 2017-07-25 at 1 32 31 pm

This error is because of the code but all the auth stuff worked okay.

screen shot 2017-07-25 at 1 36 33 pm

Can I get the name of the IAM Policy in your Identity Pool? Or if you could post a screenshot like so.

screen shot 2017-07-22 at 3 14 54 pm

jayair on 25 Jul 2017

@bradodarb One other thing to try is the Policy Simulator like @neowulf33 suggested - https://policysim.aws.amazon.com/home/index.jsp?#roles

Pick your IAM Role, Select a Service (API Gateway), Select an action (Invoke), Add the ARN and Run Simulation.

screen shot 2017-07-25 at 2 08 55 pm

jayair on 25 Jul 2017

@jugglingcats @limifont You guys can try the above as well and let me know how it goes.

jayair on 25 Jul 2017

@deepseafishing From looking at your serverless.yml it looks like the iamRoleStatements is on the save level of indentation as the provider. It shouldn't be so, compare it against the one in the repo to make sure it looks okay.

jayair on 25 Jul 2017

👍7

@mikhaelbendavid You'd need to make sure the user is created like in this chapter - http://serverless-stack.com/chapters/create-a-cognito-test-user.html

You can also go into the User Pool > Users and groups > and check if the user is enabled and confirmed like so.

screen shot 2017-07-25 at 2 19 01 pm

jayair on 25 Jul 2017

@jcowley Thanks for reporting back!

jayair on 25 Jul 2017

for those having problems with windows cmd, this worked for me:

apig-test --username [email protected] --password Passw0rd! --user-pool-id YOUR_COGNITO_USER_POOL_ID --app-client-id YOUR_COGNITO_APP_CLIENT_ID --cognito-region YOUR_COGNITO_REGION --identity-pool-id YOUR_IDENTITY_POOL_ID --invoke-url YOUR_API_GATEWAY_URL --api-gateway-region YOUR_API_GATEWAY_REGION --path-template notes --method POST --body "{\"content\":\"hello world\",\"attachment\":\"hello.jpg\"}"

algalvez on 25 Jul 2017

❤4

@algalvez Thanks for posting this. I'm sure it'll help!

jayair on 25 Jul 2017

@jayair Thank you so much. I've been trying to figure this out several hours. You saved my life, thanks! In general, is there a linter or a clever way to figure out the mistakes I made in yml file?

deepseafishing on 25 Jul 2017

👍1

@deepseafishing That's a good point. I haven't looked into it but it shouldn't be hard to do as long as there is a spec.

jayair on 25 Jul 2017

@jayair thank you for awesome support. I know once I get past my learning curve I can count on the eco-system and that's pretty great.

Not out of the woods but good to confirm whatever is buggered is between me and the aws console.

I must fundamentally misunderstand how roles operate. You've previously verified my inline policy checks out for that role and I've attached the ApiGatewateInvokeFullAccess as well yet I am denied in the policy simulator...

I've got some manuals to read I reckon.

EDIT:
I didn't input the resource url..... durr. I'll try that later and update.

bradodarb on 25 Jul 2017

Hi @jayair, I carefully followed all the steps again from scratch but this time in the us-east-1 region (I was in eu-west-1) and unfortunately get the same error. Below is my policy simulation output - looks ok.

I notice there are no Authorizers configured in the API Gateway. Is that correct?

For completeness, here is my console output (I modified all the ids):

$ apig-test \
> --username='[email protected]' \
> --password='Passw0rd!' \
> --user-pool-id='us-east-1_Xvz1pDxGp' \
> --app-client-id='190ahtjqcvde2hcm3drivdch64' \
> --cognito-region='us-east-1' \
> --identity-pool-id='us-east-1:9c221ab2-ec83-4e4f-9e41-b25ca12c5a02' \
> --invoke-url='https://fcvjf9nzlq.execute-api.us-east-1.amazonaws.com/prod' \
> --api-gateway-region='us-east-1' \
> --path-template='/notes' \
> --method='POST' \
> --body='{"content":"hello world","attachment":"hello.jpg"}'
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'Forbidden' } }

jugglingcats on 25 Jul 2017

The plot thickens.

The following error indicates the policy attached to the auth role defined in Federated Pool needs to be updated with the api gateway id

Authenticating with User Pool
Getting temporary credentials
Invalid login token. Couldn't verify signed token.

This is the error that we are all seeing.

Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'Forbidden' } }

When testing the lambda function using the serverless invocation, the result is good.

{ statusCode: 200,
  headers: 
   { 'Access-Control-Allow-Origin': '*',
     'Access-Control-Allow-Credentials': true },
  body: '{"userId":"USER-SUB-1234","noteId":"3c726b10-7185-11e7-b72a-71e7c1934e33","content":"hello world","attachment":"hello.jpg","createdAt":1501020271681}' }

When testing the lambda function directly by going to Lambda > Functions > "function name" > Test and providing the following payload to test against:

{
  "body": "{\"content\":\"hello world\",\"attachment\":\"hello.jpg\"}",
  "requestContext": {
    "identity": {
      "cognitoIdentityId": "USER-SUB-1234"
    }
  }
}

I get the following error:

{
  "errorMessage": "Cannot find module 'babel-runtime/regenerator'",
  "errorType": "Error",
  "stackTrace": [
    "Object.<anonymous> (/var/task/lambda_note_create.js:87:18)",
    "__webpack_require__ (/var/task/lambda_note_create.js:20:30)",
    "Object.<anonymous> (/var/task/lambda_note_create.js:187:20)",
    "__webpack_require__ (/var/task/lambda_note_create.js:20:30)",
    "Object.defineProperty.value (/var/task/lambda_note_create.js:63:18)",
    "Object.<anonymous> (/var/task/lambda_note_create.js:66:10)"
  ]
}

I see the same error when testing the API gateway as well via the API gateway console.

Question: Does serverless webpack invoke invoke the remote lambda function in the cloud or invoke the local function which accesses the remote dynamodb?

Update

Cloned and ran the lambda function created by https://github.com/AnomalyInnovations/serverless-es7

Looks like something wonky is going on in my deployment. Will have to investigate.

Are there any pointers in helping resolve the babel-runtime/regenerator issue?

Thanks!

neowulf on 26 Jul 2017

@neowulf33 I'm not exactly sure what's causing the babel issue. But make sure you are using Serverless 1.17.0 for now (as per this - https://github.com/AnomalyInnovations/serverless-stack-com/issues/112#issuecomment-317217381).

Edit:

Yeah serverless webpack invoke runs the function locally while accessing the remote resources.

jayair on 26 Jul 2017

@jugglingcats Can I try your repo as well? Just to make sure the issue isn't in the code.

jayair on 26 Jul 2017

@bradodarb Thanks for the update.

I'd really like to figure out what this issue is. It's probably something in the setup that we need to make clear for everybody.

jayair on 26 Jul 2017

@jayair

I used the following arn and seems to auth where it was not with '*'

What is troubling it seems to auth no matter the API Gateway Id I use....?

arn:aws:execute-api:us-east-1::ps8mmgaj2c/

vs

arn:aws:execute-api:us-east-1::super-legit-id/

both return 'allowed'

Is that expected behavior?

bradodarb on 26 Jul 2017

@bradodarb No it should not...

On the left sidebar if you click on the role, it'll show you the policy. Can you copy and paste that here?

jayair on 26 Jul 2017

@jayair , this is certainly an issue with my understanding of AWS rather than a serverless problem.
If nothing pops out at you I'll try recreating demo from scratch again.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "cognito-identity:*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::m4-user-assets/${cognito-identity.amazonaws.com:sub}*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "execute-api:Invoke"
            ],
            "Resource": [
                "arn:aws:execute-api:us-east-1:*:ps8mmgaj2c/*"
            ]
        }
    ]
}

bradodarb on 26 Jul 2017

Another follow-up, @jayair :

Ok..... made some progress. Turns out I was in fact able to follow directions(for the most part).... maybe.

I changed my test command-

From:

apig-test \
--username='[email protected]' \
--password='Passw0rd!' \
--user-pool-id='YOUR_COGNITO_USER_POOL_ID' \
--app-client-id='YOUR_COGNITO_APP_CLIENT_ID' \
--cognito-region='YOUR_COGNITO_REGION' \
--identity-pool-id='YOUR_IDENTITY_POOL_ID' \
--invoke-url='YOUR_API_GATEWAY_URL' \
--api-gateway-region='YOUR_API_GATEWAY_REGION' \
--path-template='/notes' \
--method='POST' \
--body='{"content":"hello world","attachment":"hello.jpg"}'

To:

--username='[email protected]' \
--password='Passw0rd!' \
--user-pool-id='YOUR_COGNITO_USER_POOL_ID' \
--app-client-id='YOUR_COGNITO_APP_CLIENT_ID' \
--cognito-region='YOUR_COGNITO_REGION' \
--identity-pool-id='YOUR_IDENTITY_POOL_ID' \
--invoke-url='YOUR_API_GATEWAY_URL' \
--api-gateway-region='YOUR_API_GATEWAY_REGION' \
--path-template='' \
--method='POST' \
--body='{"content":"hello world","attachment":"hello.jpg"}'

In other words I set the --path-template var to an empty string (otherwise complained about required parameter if completely omitted) and put the entire invoke-url from the console into the --invoke-url parameter(in my case : --invoke-url='https://ps8mmgaj2c.execute-api.us-east-1.amazonaws.com/dev/mail')

Now I actually get events in my Cloudwatch logs!!

_I wonder if the test tool has been updated since example created?_

Unfortunately I'm still not getting a good response but I am getting some good errors:

(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Method request path:
{}
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Method request query string:
{}
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Method request headers: {X-AMZ-Date=20170726T055040Z, Accept=application/json, CloudFront-Viewer-Country=US, CloudFront-Forwarded-Proto=https, CloudFront-Is-Tablet-Viewer=false, CloudFront-Is-Mobile-Viewer=false, User-Agent=axios/0.16.2, X-Forwarded-Proto=https, CloudFront-Is-SmartTV-Viewer=false, Host=ps8mmgaj2c.execute-api.us-east-1.amazonaws.com, x-amz-security-token=AgoGb3JpZ2luEJL//////////wEaCXVzLWVhc3QtMSKAAnRMtse6Y20itJg3up+Qzh5fGTus0ZNTbhLrh0ctiwtksJm39lPquCHM44somB5HtkSd8plWTInO9fk0FQi4woPOqVP+TZxX8qLHY0fZVx79azQ7zNw2Vdq8jn4Xu/uLRmjmpjwJUUtaHT9qHfkF2F8vLDmgLk/fQECsQWojxJo23Gs8o+cZP/aCTStmo+BYheFSr0fLTxnxTboBABlnoykhmsz9b+pk/84TuO1iDdwHgwvfBFNAQkpTlx6F7uuXRAhUEogDjODQubYX1TloxKzWZr6wSJa2nsraXXKOOds++WOl+bjBwHz3nNHcNnNPYppFTOOra7RxlWFvJeVcJ6QqpgUIJxAAGgwzOTg2OTE3NzcyMDkiDLFOebiqeaKgn14hbiqDBWw7fvPuigt/cZ++8UaIbTEVdU8XGD3CYsqCj2UtWu0Z6MwBzsOmWlv4QPnpUXp5H3D+OPglNeNuxdXl12tKLVrDX6Siy+HJsLMOegOAuoODMzhJr3LeCTa/Io2zr3H07+t0FM0meS9WX+EYI8WTkAXiESKInwaElK3CANlopQ6MY4sQPd+lAIVqWgwOlLh712W5mv8hfqlMk76zRZYKvwb [TRUNCATED]
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Method request body before transformations:
{
    "content": "hello world",
    "attachment": "hello.jpg"
}
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Endpoint request URI: https://lambda.us-east-1.amazonaws.com/2015-03-31/functions/arn:aws:lambda:us-east-1:398691777209:function:m4-user-mail-api-dev-create/invocations
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Endpoint request headers: {x-amzn-lambda-integration-tag=5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc, Authorization=****************************************************************************************************************************************************************************************************************************************************************************************************************************************83480f, X-Amz-Date=20170726T055039Z, x-amzn-apigateway-api-id=ps8mmgaj2c, X-Amz-Source-Arn=arn:aws:execute-api:us-east-1:398691777209:ps8mmgaj2c/dev/POST/mail, Accept=application/json, User-Agent=AmazonAPIGateway_ps8mmgaj2c, X-Amz-Security-Token=FQoDYXdzECYaDG7ov3zM8ORn9htN/CK3A0rTX5h6kB+EClGcy/+FlK8Xtwp5TEkvZ1yBYm7qtRXSrZwUucOP76zsEVotHLPEf5PfV8AdUg7zE+u7YgjCUGuSrf6aBjXwEdYQgpMZw7ePwTLTAjA+g/dCQtp2q59jEm48Z9v2CGkMmYn09pIYEeJf2bbkfVLr/0Hjmf9AWD8uP3m+crXYlmy8oVMTtX0jWa/T8OL8yZx8QTzp8h0izpeFXz70pXtMPIo9/ds2cU4DGvgGhd5dCO0bU/pUToerR4C37zx8G6FLXsK8CkmPiGOjpSI+EGo6kz4h1ISZYvjO8YqzlvXrv [TRUNCATED]
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Endpoint request body after transformations: {"resource":"/mail","path":"/mail","httpMethod":"POST","headers":{"Accept":"application/json","CloudFront-Forwarded-Proto":"https","CloudFront-Is-Desktop-Viewer":"true","CloudFront-Is-Mobile-Viewer":"false","CloudFront-Is-SmartTV-Viewer":"false","CloudFront-Is-Tablet-Viewer":"false","CloudFront-Viewer-Country":"US","Content-Type":"application/json","Host":"ps8mmgaj2c.execute-api.us-east-1.amazonaws.com","User-Agent":"axios/0.16.2","Via":"1.1 86f2bbfea57d6217ce2d279b84ca3743.cloudfront.net (CloudFront)","X-Amz-Cf-Id":"P8nmAi87EEbhos39DdWAGfKI3u660Y5HxTdL6JGs79Qlil6ZWUjXTw==","X-AMZ-Date":"20170726T055040Z","x-amz-security-token":"AgoGb3JpZ2luEJL//////////wEaCXVzLWVhc3QtMSKAAnRMtse6Y20itJg3up+Qzh5fGTus0ZNTbhLrh0ctiwtksJm39lPquCHM44somB5HtkSd8plWTInO9fk0FQi4woPOqVP+TZxX8qLHY0fZVx79azQ7zNw2Vdq8jn4Xu/uLRmjmpjwJUUtaHT9qHfkF2F8vLDmgLk/fQECsQWojxJo23Gs8o+cZP/aCTStmo+BYheFSr0fLTxnxTboBABlnoykhmsz9b+pk/84TuO1iDdwHgwvfBFNAQkpTlx6F7uuXRAhUEogDjODQubYX1TloxKzWZr6wSJa2nsraXXKOOd [TRUNCATED]
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Endpoint response body before transformations:
{
    "errorMessage": "Cannot find module 'babel-runtime/regenerator'",
    "errorType": "Error",
    "stackTrace": [
        "Function.Module._load (module.js:417:25)",
        "Module.require (module.js:497:17)",
        "require (internal/module.js:20:19)",
        "Object.<anonymous> (/var/task/create.js:70:18)",
        "__webpack_require__ (/var/task/create.js:20:30)",
        "Object.<anonymous> (/var/task/create.js:171:20)",
        "__webpack_require__ (/var/task/create.js:20:30)",
        "/var/task/create.js:63:18",
        "Object.<anonymous> (/var/task/create.js:66:10)"
    ]
}
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Endpoint response headers: {x-amzn-Remapped-Content-Length=0, x-amzn-RequestId=5a92e8f2-71c6-11e7-8456-71a6d7356212, Connection=keep-alive, Content-Length=492, X-Amz-Function-Error=Unhandled, Date=Wed, 26 Jul 2017 05:50:39 GMT, X-Amzn-Trace-Id=root=1-59782daf-0b908232481c89670257abc5;sampled=0, Content-Type=application/json}
(5a7bdeb9-71c6-11e7-9822-09ff9d23e4cc) Execution failed due to configuration error: Malformed Lambda proxy response

Seems like a possible deployment issue now?

bradodarb on 26 Jul 2017

Some cursory googling on that last line led me to believe the response object from the create function should be stringified so I changed the callback to this:

        callback(null, success(JSON.stringify(params.Item), 201));

But no dice.... same error shows up in logs.

bradodarb on 26 Jul 2017

@bradodarb I am having something similar in my logs, have you found a solution for that?

This is from CloudWatch

Unable to import module 'create': Error
at Function.Module._load (module.js:417:25)
at Module.require (module.js:497:17)
at require (internal/module.js:20:19)
at Object.<anonymous> (/var/task/create.js:76:18)
at __webpack_require__ (/var/task/create.js:20:30)
at Object.<anonymous> (/var/task/create.js:167:20)
at __webpack_require__ (/var/task/create.js:20:30)
at /var/task/create.js:63:18
at Object.<anonymous> (/var/task/create.js:66:10)

And this is directly when I try to test the create method in the API Gateway

Wed Jul 26 10:56:00 UTC 2017 : Received response. Integration latency: 75 ms
Wed Jul 26 10:56:00 UTC 2017 : Endpoint response body before transformations: 
{"errorMessage":"Cannot find module 'babel-runtime/regenerator'","errorType":"Error","stackTrace
["Object.<anonymous> (/var/task/create.js:76:18)","__webpack_require__
(/var/task/create.js:20:30)","Object.<anonymous> 
(/var/task/create.js:167:20)","__webpack_require__ 
(/var/task/create.js:20:30)","/var/task/create.js:63:18",
"Object.<anonymous> (/var/task/create.js:66:10)"]}

sidthe on 26 Jul 2017

Found this https://github.com/serverless/serverless/issues/3918

sidthe on 26 Jul 2017

@sidthe - I stumbled across that as well. I have no .npmrc in my project and I checked my global .npmrc and long=true was not present.

bradodarb on 26 Jul 2017

@sidthe Your error looks like the one people were seeing above - https://github.com/AnomalyInnovations/serverless-stack-com/issues/112#issuecomment-317217381

Just make sure you are running Serverless 1.17.0 for now.

@bradodarb For your case as well. It's a bit weird that it's not packaging the dependency babel-runtime. Make sure you are on 1.17.0 by running serverless -v.

jayair on 26 Jul 2017

@jayair I am on 1.17.0

I just got rid of the error by including into the serverless.yml the following

package:
  excludeDevDependencies: false

I am now getting a 500 but at least no dependency issue in the log

sidthe on 26 Jul 2017

👍1

@jayair my bad, I was indeed on 1.18.0, looks like accidentally updated. Now the package dependency is gone, even without the above fix. Still getting a status:false, but probably not the same issue

sidthe on 26 Jul 2017

@sidthe That makes sense. You shouldn't need the excludeDevDependencies flag on 1.17.0. For the status: false follow this - http://serverless-stack.com/chapters/test-the-apis.html#common-issues

jayair on 26 Jul 2017

@jayair thanks a lot. One more question related to the chapter. My API test returns 500. Interestingly enough however, when I run the test from within Lambda, they execute succesfully and I get the data back. Any reason the function test would pass in Lambda but would return a server error in API Gateway?

I added logging to the handlers, but nothing shows up in the logs.

sidthe on 26 Jul 2017

@sidthe When you run the test from Lambda, do you mean in your local or through the AWS Console?

jayair on 26 Jul 2017

@jayair through the aws console

sidthe on 26 Jul 2017

I did indeed need to downgrade my serverless version as @jayair mentioned:

$ npm uninstall -g serverless
$ npm install -g [email protected]

To enable cloudwatch logs for api gateway:

https://kennbrodhagen.net/2016/07/23/how-to-enable-logging-for-api-gateway/

After following the steps in the previous article, I have staged the api gateway. I am able to look at logs coming in from api gateway and lambda functions. These two services can be tested independently.

Thanks to @jcowley 's comment - I now get the proper http response when invoking the staged api gateway url (notice my --invoke-url):

$ apig-test \
> --username='[email protected]' \
> --password='Passw0rd!' \
> --user-pool-id='xxxx' \
> --app-client-id='xxxx' \
> --cognito-region='us-west-2' \
> --identity-pool-id='xxxx' \
> --invoke-url='https://xxxx.execute-api.us-west-2.amazonaws.com/stage' \
> --api-gateway-region='us-west-2' \
> --path-template='/notes' \
> --method='POST' \
> --body='{"content":"hello world","attachment":"hello.jpg"}'

Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 200,
  statusText: 'OK',
  data: 
   { userId: 'us-west-2:a2e882d0-af59-472b-9ff5-6d1234527bcb',
     noteId: '8e5b69a0-7238-11e7-a677-77f7a43d3005',
     content: 'hello world',
     attachment: 'hello.jpg',
     createdAt: 1501097289018 } }

Thank you for this discussion! It was most helpful!

neowulf on 26 Jul 2017

ok, so my problem was different. Since my app is slightly different then the example, dynamo was expecting the range key in the call, which is not the usedid and this was triggering the failure.

sidthe on 26 Jul 2017

Sure enough, rolling version back to 1.17.0 (from 1.18.0) did the trick and I'm able to successfully access my services. Thank you for your assistance, @jayair !!

The only thing a bit weird is the parameters for the testing cli.

If I have the entire URL in the --invoke-url parameter and keep --path-template empty it works.

So this accesses my APIs -

--invoke-url='https://xxxx.execute-api.us-west-2.amazonaws.com/dev/notes'
--path-template=''

If however I try:

--invoke-url='https://xxxx.execute-api.us-west-2.amazonaws.com/dev'
--path-template='/notes'

I get the 403 forbidden error.

At this point perhaps I should raise it as an issue in the test tool's repo....

Thanks again!

bradodarb on 26 Jul 2017

👍2 ❤1 🎉1

Thanks @bradodarb I get exactly the same results as you... I have to put everything in the invoke-url.

I no longer get 403 -- and get 200 or 500 depending on whether my lambda function was successful - ie. whether my code is correct - happy days!!

jugglingcats on 26 Jul 2017

@bradodarb @jugglingcats That's great to hear!

@neowulf33 Thanks to your detailed report back we've resolved this issue!

@bradodarb Also, if you could submit an issue in regards to apig-test that'll be great. I need to figure out what is going on there.

jayair on 27 Jul 2017

Hi @jayair, I'm having the same problem as @limifont with the {status: 401 .... unauthorized }. I checked the policy simulator output and it seems to be fine. Any ideas?
I also can't check my cloudwatch logs because it doesn't seem to be getting through api gateway, so it never reaches the lambda functions.

With further investigation, I found that I was able to call the /OPTIONS endpoint, but none of my actual lambda functions, so I feel like it has something to do with my Cognito authentication.

clifftai on 27 Jul 2017

@clifftai Hmmm just to make sure you are using Serverless 1.17.0?

jayair on 27 Jul 2017

@jayair Yep, on Serverless 1.17.0, Node 6.11.1, npm 5.0.3. If this helps, I turned off authorization in Gateway for each individual method, and that works and allows me to call each endpoint, though that seems like a fairly large security vulnerability.

clifftai on 27 Jul 2017

@clifftai Since you checked the Policy Simulator already, just check and make sure the User Pool and Identity Pool are linked properly. The User Pool is added as a Authentication Provider in the Identity Pool like in this chapter - http://serverless-stack.com/chapters/create-a-cognito-identity-pool.html.

jayair on 27 Jul 2017

Testing api with POST request works but with GET request fails.

apig-test --username ***** --password **** --user-pool-id us-west-**** --app-client-id **** --cognito-region us-west-2 --identity-pool-id us-west-2:**** --invoke-url https://****.execute-api.us-west-2.amazonaws.com/prod --api-gateway-region us-west-2 --path-template /inventory --method GET
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 500,
  statusText: 'Internal Server Error',
  data: { status: false } }

list.js function

import * as dynamoDbLib from './../../libs/dynamodb-lib';
import { success, failure } from './../../libs/response-lib';

export async function main(event, context, callback) {
  const params = {
    TableName: 'inventory',
  };

  try {
    const result = await dynamoDbLib.call('query', params);
    // Return the matching list of items in response body
    callback(null, success(result.Items));
  }
  catch(e) {
    console.log('list:', e);
    callback(null, failure({status: false}));
  }
};

Any ideas what it could be? I'm just trying to retrieve all items no filtering.

copperspeed on 30 Jul 2017

@copperspeed Did you try checking what the console.log('list:', e) is returning? You can have a look in the CloudWatch logs. Here is some more info on it http://serverless-stack.com/chapters/test-the-apis.html#common-issues.

jayair on 30 Jul 2017

@jayair My agin-test fails with a 500 Internal server error.

The Cloudwatch log shows a credential error in /home/sbx_user1060/.aws/credentials'. Am I missing something in creating the user credentials?

2017-07-31T09:13:36.802Z    888b308b-75d0-11e7-b558-b75c1d7d9052    create: { CredentialsError: Missing credentials in config
at Error (native)
at Object.fs.openSync (fs.js:641:18)
at Object.fs.readFileSync (fs.js:509:33)
at Object.readFileSync (/var/runtime/node_modules/aws-sdk/lib/util.js:97:26)
at SharedIniFile.loadFile [as ensureFileLoaded] (/var/runtime/node_modules/aws-sdk/lib/shared_ini.js:19:18)
at SharedIniFile.loadProfileNames [as getProfiles] (/var/runtime/node_modules/aws-sdk/lib/shared_ini.js:61:10)
at SharedIniFileCredentials.refresh (/var/runtime/node_modules/aws-sdk/lib/credentials/shared_ini_file_credentials.js:91:45)
at SharedIniFileCredentials.get (/var/runtime/node_modules/aws-sdk/lib/credentials.js:121:12)
at getAsyncCredentials (/var/runtime/node_modules/aws-sdk/lib/config.js:327:24)
at Config.getCredentials (/var/runtime/node_modules/aws-sdk/lib/config.js:347:9)
message: 'Missing credentials in config',
errno: -2,
code: 'CredentialsError',
syscall: 'open',
path: '/home/sbx_user1060/.aws/credentials',
time: 2017-07-31T09:13:36.798Z,
originalError: 
{ message: 'Could not load credentials from SharedIniFileCredentials',
errno: -2,
code: 'CredentialsError',
syscall: 'open',
path: '/home/sbx_user1060/.aws/credentials',
time: 2017-07-31T09:13:36.797Z,
originalError: 
{ errno: -2,
code: 'ENOENT',
syscall: 'open',
path: '/home/sbx_user1060/.aws/credentials',
message: 'ENOENT: no such file or directory, open \'/home/sbx_user1060/.aws/credentials\'' } } }

RaphaelMui on 31 Jul 2017

@RaphaelMui It looks like you have multiple profiles. I think somebody else had talked about this in the comments for one of the chapters. Maybe this will help you - https://github.com/AnomalyInnovations/serverless-stack-com/issues/23#issuecomment-317851626

jayair on 31 Jul 2017

Thanks @jayair. Yes, I have more than 1 profile. The problem solved after I removed my AWS,SharedIniFileCredentials() codes.

RaphaelMui on 1 Aug 2017

@RaphaelMui I think we might need some conditional code in there to distinguish between the local and live cases.

jayair on 1 Aug 2017

One can also pin the framework version by specifying the following line in the serverless.yml

frameworkVersion: "=1.17.0"

Serverless Documentation Link

neowulf on 3 Aug 2017

If you'd like to automate enabling the logs, you can follow this serverless config:

http://forum.serverless.com/t/how-to-enable-cloud-watch-logs-for-api-gateway-using-serverless/2067/2

neowulf on 3 Aug 2017

👍1

@neowulf33 Good tips!

jayair on 7 Aug 2017

When I log my apig-test in both the HTML request logging, and API request logging, I get no errors in the actual API Log, but in the HTML log I get ...

AccessDeniedException: User: arn:aws:sts::481588845003:assumed-role/hrs-admin-api-prod-ap-southeast-2-lambdaRole/hrs-admin-api-prod-create is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:ap-southeast-2:481588845003:table/notes

But the calls work fine from two chapters ago. I can create, update, edit, delete, etc... But I can't do it authorised from the apig_test. :(

michaelcuneo on 8 Aug 2017

@michaelcuneo That should be easy to fix. Can I see your serverless.yml?

In the past chapters we were invoking it directly using your local credentials. The apig-test is mocking how a user will be accessing it.

jayair on 8 Aug 2017

My serverless.yml is identical to the one as per the tutorial...

http://mcuneo.webhop.me/misc/serverless.yml

michaelcuneo on 8 Aug 2017

I did actually run through a bunch of issues that it could have been, I've added AWSLambdaRole and AmazonDynamoDBFullAccess permission to the Admin user I've created, but it didn't help. I'm using all the correct keys and secrets for that admin user, everything works 100% without auth, but fails with auth. Baffled. I've been on this issue for hours.

michaelcuneo on 8 Aug 2017

@michaelcuneo Yeah the issue is in your serverless.yml in this line.

Resource: "arn:aws:dynamodb:ap-southeast-2a:*:*"

It should be.

Resource: "arn:aws:dynamodb:ap-southeast-2:*:*"

You can see this in the error "...on resource: arn:aws:dynamodb:ap-southeast-2:481588845003:table/notes". It's looking for the table in the region ap-southeast-2.

jayair on 8 Aug 2017

Damn! It is too! I always forget that. Cause ap-southeast-2 has an a and b, but they both go to just 2.

Thanks! Works perfect now.

michaelcuneo on 8 Aug 2017

👍1

On a Mac w/serverless v1.19.0 I initially received the following output after running the apig-test command with good parameters:

Authenticating with User Pool
Getting temporary credentials
Invalid identity pool configuration. Check assigned IAM roles for this pool.

I confirmed I'd followed the Identity Pool instructs correctly, but noticed Authenticated and Unauthenticated roles had not been attached to my Identity Pool. After selected the Auth_Role from the Edit identity pool dropdown and creating a new Unauth_Role (just accepting the default policy json), and saving the changes, the same apig-test command worked as expected.

Did I miss something in the instructions, or are additional instructions needed?

pjamieson on 9 Aug 2017

@pjamieson You should not have to do that. It should be attached. I wonder if it didn't get saved properly the first time around. How did you find out that they weren't attached? Can you show me a screenshot? Thanks.

jayair on 10 Aug 2017

👍1

@jayair You are correct; it apparently was not saved correctly. I deleted my initial Identity Pool and the two associated IAM Roles, recreated the Identity Pool as per the instructions, and the roles are there as they should be. And the apig-test works as it should, too. All with serverless 1.19.0. Thanks! (Great turorial. I'm back after having done the prior version about two months ago. Thanks for pointing the way to Identity Pools.)

pjamieson on 10 Aug 2017

👍1

BTW, it seems that an apostrophe character (') in the content string breaks the apig-test command execution. (Just an FYI; I'm just removing it.) I see it's due to the body being enclosed in single quotes.

pjamieson on 10 Aug 2017

@pjamieson Thanks for reporting on 1.19.0. Just removed the 1.17.0 restriction.

jayair on 11 Aug 2017

I had the same apig-test error as @tsdorsey and deepseafishing above:
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 500,
statusText: 'Internal Server Error',
data: { status: false } }

with the following error being reported in CloudWatch:
message: 'User: arn:aws:sts::386757086157:assumed-role/notes-app-api-prod-us-west-2-lambdaRole/notes-app-api-prod-create is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:us-west-2:386757086157:table/notes',
code: 'AccessDeniedException',
time: 2017-08-11T03:03:28.333Z,
statusCode: 400,

It did turn out to be caused by the indentation in the serverless.yml file where the iamRoleStatements: were also indented at the same level as provider: instead of one level lower and therefore got ignored without error.

Properly indenting that section with tabs fixed the problem and apig-test now successfully reported:
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 200,
statusText: 'OK',
data:
{ userId: 'us-west-2:c25c8604-477a-4eeb-921f-dcb2ea30ebe9',
noteId: '66f305b0-7e47-11e7-81ba-45b2b0dbb6ab',
content: 'hello world',
attachment: 'hello.jpg',
createdAt: 1502423079307 } }

running on Mac OS X 10.12.6 with:
node v6.11.1
npm 3.10.10
aws-sdk 2.95.0
webpack 3.5.3
serverless 1.19.0

Thanks you for this tutorial.

gregt590 on 11 Aug 2017

👍3

Thanks for reporting back @gregt590. The indenting issues causes a lot of headaches for folks.

jayair on 11 Aug 2017

😕1 👍1

PLEASE HELP!! I have read through the tutorial very carefully and have been struggling over this for so long.

Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">\n<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">\n<TITLE>ERROR: The request could not be satisfied</TITLE>\n</HEAD><BODY>\n<H1>ERROR</H1>\n<H2>The request could not be satisfied.</H2>\n<HR noshade size="1px">\nBad request.\n<BR clear="all">\n<HR noshade size="1px">\n<PRE>\nGenerated by cloudfront (CloudFront)\nRequest ID: 21E5qKTlLx8RJytknBwPbE9kFWg3CNUxFLD_N3xMhAhO7BpxiTzKhg==\n</PRE>\n<ADDRESS>\n</ADDRESS>\n</BODY></HTML>' }

jeffxie888 on 12 Aug 2017

@jeffxie888 It looks like we might be hitting the wrong URL? Can I see the full apid-test command?

jayair on 12 Aug 2017

I get 403 Bad Signature response too in various of my endpoints. I've tried to put the whole URL in invoke_url and it didn't help me:

{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.\n\nThe Canonical String for this request should have been\n\'GET\n/dev/feed\npage=0&page_size=10\naccept:application/json\nhost:wex1vzo67b.execute-api.us-east-1.amazonaws.com\nx-amz-date:20170814T172052Z\n\naccept;host;x-amz-date\ne3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\'\n\nThe String-to-Sign should have been\n\'AWS4-HMAC-SHA256\n20170814T172052Z\n20170814/us-east-1/execute-api/aws4_request\nb53eba78268cf91932fa865871dd575a129681dcd4d3a9e79a676034efa1c419\'\n' } }

However, I may have found a pattern. I created a new service and started deploying each endpoint separately so I could find the reason of fails:

GET user by Id: xxxx/users/id/123 Works fine
GET user by Email: xxxx/users/email/[email protected] Doesn't work
GET user by Email v2: xxxx/users/[email protected] Doesn't work
GET feed: xxxx/feed?page=0&page_size=10 Doesn't work

I tried to transform special characters into URL valid characters and still didn't work. Then I tried to search for testtest.com and I got a 404 as expected. And feed without page information returns 500 as expected too.

I'm currently moving all that information to body in requests, but that forces me to only use POST as requests method.

Is there a way to use special characters in URLs and don't getting 403 Bad Signature as response?

Thank you and thank you for this awesome tutorial 👍

Cotel on 14 Aug 2017

@Cotel Thanks for details.

Case 3 & 4 contain querystring parameters that need to be passed in as an object into the additional-params option ({page:0,page_size:10}). For case 2, since we need the email part encoded we can send that in as a part of the params as well. So it could look like /users/email/{emailId} and the params option would be {emailId:"[email protected]"}. Give that a try and let me know how that goes.

For apig-test we internally use the https://github.com/kndt84/aws-api-gateway-client, and they have an example on how to use these options as well. We could work on making this more user friendly though.

jayair on 14 Aug 2017

I just tried to replace the params and now it is working as expected! Thank you 💯

Cotel on 16 Aug 2017

@Cotel 👌

Once you get to the frontend portion you would need to do something similar. Let me know how that goes.

jayair on 16 Aug 2017

I'm now making the react part and it returns the same error as when testing with the cli tool:

export const getDatabaseUser = (email, userToken) =>
    invokeApig({
        path: `/users/email/${email}`
    }, userToken)

I am sure the userToken is arriving correctly to this method. Configuration is set properly and the IAM role simulation allows me to invoke the Api. awsLib.js and sigv4Client.js is copy paste from the tutorial...

The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details.The Canonical String for this request should have been'GET/dev/users/email/test%40test.comaccept:application/json↵host:wex1vzo67b.execute-api.us-east-1.amazonaws.comx-amz-date:20170817T183520Zaccept;host;x-amz-datee3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'The String-to-Sign should have been'AWS4-HMAC-SHA25620170817T183520Z20170817/us-east-1/execute-api/aws4_request57959ea0b29bcb252d83b38d563e3b3e67684f8eba45439fdf1f4ea21f69f856'"

Cotel on 17 Aug 2017

in windows command line, should remove all double quotes, like --username=myname
for the value in json format, it should be look like this:
--body="{\"content\":\"hello world\", \"attachment\":\"dog.jpg\"}"

everrr1025 on 19 Aug 2017

@everrr1025 Thanks for letting us know. I'm thinking of putting together a separate chapter on the differences for Windows.

jayair on 20 Aug 2017

@Cotel I thought I had replied to your comment but I think I must have not sent it.

The email that you are passing in as a part of the path needs to be URL encoded. Instead of [email protected], it needs to be test%40test.com. You can do this by hand or your can use something like https://github.com/bramstein/url-template.

jayair on 20 Aug 2017

i am on windows and i get 403 forbidden, i have readed all comments until the end, installed version 1.17 , copy pasted the yml file, changed ' with ", on my local machine i can invoke the functions, on the IAM simulator i can invoke the Amazon API Gateway, but the apig-test still doesnt work for me.

Is this test necesary to continue the rest of the tutorial? can i continue even if apig-test failed?

Spartano on 22 Aug 2017

@Spartano Can I see the full command and the error message you are seeing? If it doesn't work here it most likely won't work down the road.

jayair on 23 Aug 2017

@jayair
```
apig-test --username [email protected] --password Passw0rd! --user-pool-id eu-west-1_xxxx --app-client-id 5baajsxxxxx --cognito-reg
ion eu-west-1 --identity-pool-id eu-west-1:bxxxxxx4-ad01-9e72a51c2b0f --invoke-url https://rxxxxxxni.execute-api.eu-west-1.amazonaws.com/prod
--api-gateway-region eu-west-1 --path-template notes --method POST --body "{\"content\":\"hello world\",\"attachment\":\"hello.jpg\"}"
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
statusText: 'Forbidden',
data: { message: 'Forbidden' } }

package.json

{
"name": "notes-app-api",
"version": "1.0.0",
"description": "",
"main": "handler.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC",
"devDependencies": {
"aws-sdk": "^2.95.0",
"babel-core": "^6.25.0",
"babel-loader": "^7.1.1",
"babel-plugin-transform-runtime": "^6.23.0",
"babel-preset-es2015": "^6.24.1",
"babel-preset-stage-3": "^6.24.1",
"glob": "^7.1.2",
"serverless-webpack": "^2.2.0",
"webpack": "^3.5.2",
"webpack-node-externals": "^1.6.0"
},
"dependencies": {
"babel-runtime": "^6.25.0",
"uuid": "^3.1.0"
}
}

```

What are the steps that one could make to debug this problem?
When i created the
From my point of view id love to see a extra tutorial on debugging the API calls, like the IAM Simulator and enabling CloudWatch Logs and how to use them.

Spartano on 23 Aug 2017

@Spartano Yeah a debugging related chapter is definitely on our list.

So far what you posted looks good. But you'd generally start by looking at your CloudWatch logs to see where the 403 is being returned. Let me know if you've done that already.

Also, double checking your serverless.yml. So if you could post that as well.

jayair on 23 Aug 2017

@jayair so, to wrap up, i can invoke the functions from my local development, and in my CloudWatch i dont get any error, it seems like the calls never get to the cloud.

service: reviso-time-tracking

# Use serverless-webpack plugin to transpile ES6/ES7
plugins:
  - serverless-webpack

# Enable auto-packing of external modules
custom:
  webpackIncludeModules: true

provider:
  name: aws
  runtime: nodejs6.10
  stage: prod
  region: eu-west-1

  # 'iAmRoleStatement' defines permission policy for Lambda function
  # We are granting Lambda functions permission to access Dynamo DB
  iAmRoleStatement:
   - Effect: Allow
     Action:
       - dynamodb:DescribeTable
       - dynamodb:Query
       - dynamodb:Scan
       - dynamodb:GetItem
       - dynamodb:PutItem
       - dynamodb:UpdateItem
       - dynamodb:DeleteItem
     Resource: "arn:aws:dynamodb:eu-west-1:*:*"

functions:
  #Defines an HTTP API endpoint that calls the main function in create.js
  # - path: rul path is /notes
  # - method: POST request
  # - cors: enabled CORS for browser cross domain API calls
  # - authorizer: authenticate using the AWS IAM role
  create:
    handler: create.main
    events:
      - http:
          path: notes
          method: post
          cors: true
          authorizer: aws_iam

  get:
    #Defines HTTP API endoing that calls main function in get.js
    # - path: url path is /notes/{id}
    # - method: GET request
    handler: get.main
    events:
      - http:
          path: notes/{id}
          method: get
          cors: true
          authorizer: aws_iam

  list:
     handler: list.main
     events:
       - http:
          path: notes
          method: get
          cors: true
          authorizer: aws_iam

  update:
     handler: update.main
     events:
       - http:
          path: notes/{id}
          method: put
          cors: true
          authorizer: aws_iam

  delete:
     handler: delete.main
     events:
       - http:
          path: notes/{id}
          method: delete
          cors: true
          authorizer: aws_iam

Spartano on 23 Aug 2017

@Spartano That also looks okay. I think the 403 is coming from API Gateway. API Gateway logs are not on by default and are a little trickier to turn on. Can you try this - https://kennbrodhagen.net/2016/07/23/how-to-enable-logging-for-api-gateway/ and see if you get something in the logs?

jayair on 24 Aug 2017

@jayair i am making some progress, the problem was in the syntax of the apig code, since i am on windows.
I am using Visual Code and i have bash integrated, so i have wrongly presumed that i could use the same syntax. When i changed terminal, i was finaly able to see the errors inside the terminal and in the cloud watch.

in one of the above comments there is a command for windows, but the problem was it was missing some empty spaces. The correct command that worked for me was this:
apig-test --username [email protected] --password Passw0rd! --user-pool-id eu-west-1_pxxxxGN --app-client-id 5bxxxxxg29iudh93 --cognito-region eu-west-1 --identity-pool-id eu-west-1:398cxxxxxx9adf1037 --invoke-url https://vxxxxvj.execute-api.eu-west-1.amazonaws.com/prod/ --api-gateway-region eu-west-1 --path-template notes --method POST --body "{\"content\":\"hello world\",\"attachment\":\"hello.jpg\"}"

now i am getting is not authorized to perform: dynamodb:PutItem on resource: arn:aws:dynamodb:eu-west-1

it will be really nice a guide on how to test it with Postman or another service, so it doenst matter what OS you are using.

Spartano on 24 Aug 2017

@Spartano That makes sense. Thanks for trying to debug it more.

I just noticed that there is a typo in your serverless.yml. It should say iamRoleStatements instead of iamRoleStatement; like so https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/serverless.yml#L17.

jayair on 24 Aug 2017

Have this problem with status: 500:

 Authenticating with User Pool
 Getting temporary credentials
 Making API request
 { status: 500,
  statusText: 'Internal Server Error',
  data: { status: false } }

The problem was in serverless.yml fiile under the line
Resource: "arn:aws:dynamodb:us-west-2:*:*"
The was the wrong region because I don't change it from the example's one.
When I change region i receive

{ status: 200,
  statusText: 'OK',
  data:
   { userId: 'us-west-2:adb2febb-8fae-4745-98b6-4481cb8655d1',
     noteId: 'f1962400-89a4-11e7-8c05-5928f46acd0b',
     content: 'hello world',
     attachment: 'hello.jpg',
     createdAt: 1503672717889 } }

I also downgrade the serverless as was mentioned in previous comments.

@jayair Please add part in tutorial on proper region settings. I came across this problem in earlier chapters but was able to notice it. This one with api deploying gave me some pain.

SeanSilke on 25 Aug 2017

@SeanSilke Thanks for reporting back. Yeah I'll add a note in the parts that need a region change.

jayair on 26 Aug 2017

👍1

I was experiencing the same errors as @tsdorsey and @thesavvygreek - 502 Bad Gateway and Unable to import module 'create': Error being reported in the CloudWatch logs.

fixed it by:

downgrading to serverless 1.17.0 as @jayair suggested
used the Roles Simulator to verify that serverless IAM roles were configured properly
Enabling CloudWatch logging, discovered Unable to import module error
Found this comment on a similar issue reported to serverless-webpack

tldr; check your package.json and ensure that babel-runtime is listed under dependencies. If it isn't, yarn add babel-runtime and redeploy serverless

also, per the linked issue's discussion thread, make sure that

custom:
  webpackIncludeModules: true

is included in your serverless.yml (it should be if you configured serverless as described in the tutorial)

zacacollier on 3 Sep 2017

👍1

@zacacollier Thanks for the really detailed report back. I'm working on a chapter for debugging and your feedback will help with that.

jayair on 3 Sep 2017

@zacacollier You don't need to downgrade to serverless 1.17.0.
I am using 1.21.0 and it works just by adding babel-runtime in dependencies.
Great find man. thanks

bumblebeen on 5 Sep 2017

👍1

@bumblebeen Yeah if I recall, it was 1.18 that was giving folks problems.

jayair on 5 Sep 2017

👍1

When running apig-test I get the following error:

Authenticating with User Pool
/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/request.js:31
            throw err;
            ^

TypeError: callback.newPasswordRequired is not a function
    at /usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/amazon-cognito-identity-js/lib/CognitoUser.js:281:27
    at Response.<anonymous> (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/amazon-cognito-identity-js/lib/CognitoUser.js:249:18)
    at Request.<anonymous> (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/request.js:364:18)
    at Request.callListeners (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/sequential_executor.js:105:20)
    at Request.emit (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/sequential_executor.js:77:10)
    at Request.emit (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/request.js:683:14)
    at Request.transition (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/request.js:22:10)
    at AcceptorStateMachine.runTo (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/state_machine.js:14:12)
    at /usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/state_machine.js:26:10
    at Request.<anonymous> (/usr/local/lib/node_modules/aws-api-gateway-cli-test/node_modules/aws-sdk/lib/request.js:38:9)

paolini on 5 Sep 2017

@paolini It looks like you might have created this user through the AWS Console? In this case the user is required to set a password when they first login. The apig-test CLI does not handle this case and expects that the user credentials are valid and can be used.

jayair on 6 Sep 2017

👍1

Yes thanks, that's the case... Seems there is no way to change or confirm the password from the aws console.

paolini on 6 Sep 2017

My next issue: IdentityPool not found.

I checked that the identityPoolId is correct:

$ aws cognito-identity list-identity-pools --max-results 10
{
    "IdentityPools": [
        {
            "IdentityPoolName": "notes identity pool",
            "IdentityPoolId": "eu-central-1:554ec0d7-0cd3-41e5-b5f9-cad20d34XXXX"
        }
    ]
}
$ apig-test --username=pippo --password=password --user-pool-id=eu-central-1_3w4UEXXXX --app-client-id 267es0fnrdurq91phh2afnXXXX congnito-region eu-central-1 --identity-pool-id eu-central-1:554ec0d7-0cd3-41e5-b5f9-cad20d34XXXX --invoke-url https://9goegkXXXX.execute-api.eu-central-1.amazonaws.com/prod --path-template notes --method POST --body {"content":"hello world"}
Authenticating with User Pool
Getting temporary credentials
IdentityPool 'eu-central-1:554ec0d7-0cd3-41e5-b5f9-cad20d34XXXX' not found.

paolini on 6 Sep 2017

👍1

@paolini Just glancing at your command. Shouldn't the congnito-region should be --congnito-region?

jayair on 6 Sep 2017

Thanks again. You are right! Now I reduced my problem to 403 Forbidden... :-(

paolini on 7 Sep 2017

I tried everything that I can and could not find anything wrong. the serverless.yml is same as posted here. but when I am test, I always got 403 error. it is running on Windows 7 and below is the output.

apig-test .............................
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
  statusText: 'Forbidden',
  data: { message: 'Forbidden' } }

D:\app-api>serverless -v
1.17.0

D:\app-api>npm -v
5.4.0

D:\app-api>node -v
v6.11.2

u8006082 on 7 Sep 2017

@u8006082 If you are on Windows, @Spartano's comment https://github.com/AnomalyInnovations/serverless-stack-com/issues/112#issuecomment-324556718 from above might help you. I think he was having the 403 error before as well.

@paolini @u8006082 Another thing to make sure to try is the IAM policy simulator - https://github.com/AnomalyInnovations/serverless-stack-com/issues/112#issuecomment-317821887.

jayair on 7 Sep 2017

Thanks Jayair! I missed "/" after prod. it should be https://hyuzdjsm1e.execute-api.us-east-1.amazonaws.com/prod/

by the way for window user you can use ^ (unix is ) to separate the line.

u8006082 on 7 Sep 2017

I am running the following command and getting an error:
apig-test \ --username='[email protected]' \ --password='Passw0rd!' \ --user-pool-id='us-west-2_*********' \ --app-client-id='*****************************' \ --cognito-region=‘us-west-2’ \ --identity-pool-id='us-west-2:***************************************' \ --invoke-url='https://***********.execute-api.us-west-2.amazonaws.com/prod' \ --api-gateway-region=‘us-west-2’ \ --path-template='/notes' \ --method='POST' \ --body='{"content":"hello world","attachment":"hello.jpg"}'

Error:
Inaccessible host:cognito-identity.xn--us-west-2-**.amazonaws.com'. This service may not be available in the ‘us-west-2’' region.

I've done some searching on this and am not finding a solution. Anybody familiar with this issue?

samxi on 16 Sep 2017

@samxi Hmmm that seems strange. The only thing I can think of here is to double check the Cognito id's that are being set and make sure that the region info for them is correct.

jayair on 16 Sep 2017

@samxi there is no space after each comand correct: "apig-test/space"
not vorrect:"apig-testspace/space"

Spartano on 16 Sep 2017

@jayair @Spartano

I removed the space before \ on my invoke command and got a new error:
Authenticating with User Pool Getting temporary credentials Making API request { status: 403, statusText: 'Forbidden', data: { Message: 'User: arn:aws:sts::904892619278:assumed-role/Cognito_notesidentitypoolAuth_Role/CognitoIdentityCredentials is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-west-2:********9278:zgbqusr8ua/prod/POST/notes' } }

I tried @Jonarod 's suggestion and deleted my initial identity and created a new identity. Now I am getting a 500 error:
{ status: 500, statusText: 'Internal Server Error', data: { status: false } }

The command I am using was updated to the new identity ID:
apig-test --username='[email protected]' --password='Passw0rd!' --user-pool-id='us-west-2_XOwARY4ea' --app-client-id='6k30s80bm1agn9c1pbjdhnn1p3' --cognito-region='us-west-2' --identity-pool-id='us-west-2:b1a93438-17a6-4c6c-91a2-31b4883da2a8' - -invoke-url='https://zgbqusr8ua.execute-api.us-west-2.amazonaws.com/prod' --api-gateway-region='us-west-2' --path-template='/notes' --method='POST' --body='{"content":"hello world","attachment":"hello.jpg"}'

My Auth_Role policy for the role in IAM is:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "mobileanalytics:PutEvents", "cognito-sync:*", "cognito-identity:*" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": [ "arn:aws:s3:::sambb-notes-app-uploads/${cognito-identity.amazonaws.com:sub}*" ] }, { "Effect": "Allow", "Action": [ "execute-api:Invoke" ], "Resource": [ "arn:aws:execute-api:us-west-2:*:zgbqusr8ua/*" ] } ] }

Not sure what else I am missing. I set up a new role for CloudWatch logging but am not sure how that works.

samxi on 18 Sep 2017

@samxi the syntax of --invoke is wrong, and double check the .yml syntax with the one from the guide.

apig-test --username [email protected] --password Passw0rd! --user-pool-id YOUR_COGNITO_USER_POOL_ID --app-client-id YOUR_COGNITO_APP_CLIENT_ID --cognito-region YOUR_COGNITO_REGION --identity-pool-id YOUR_IDENTITY_POOL_ID --invoke-url YOUR_API_GATEWAY_URL --api-gateway-region YOUR_API_GATEWAY_REGION --path-template notes --method POST --body "{\"content\":\"hello world\",\"attachment\":\"hello.jpg\"}"

Spartano on 19 Sep 2017

@jayair @Spartano

Rolling through all of the files/settings again I found a couple discrepancies and was able to get things working properly. Reading through these comments and all of your suggestions has helped me better understand the whole system and improve my troubleshooting skills.

Thank you both for your quick responses and help!

samxi on 19 Sep 2017

👍1

@jayair I am getting following error:
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 403,
statusText: 'Forbidden',
data: { message: 'Forbidden' } }
I've tried everything (double checking my .YML file, policy, policy simulating, etc) but nothing works for me. Can you please help me with this issue? Following is my github repo:
https://github.com/nvamshik/notes-app-api

nvamshik on 23 Sep 2017

@nvamshik what OS are you using?

Spartano on 23 Sep 2017

@Spartano I'm using Windows 8.1

nvamshik on 23 Sep 2017

Did you use the syntax for windows users from the guide? Can you paste it here please.

Spartano on 23 Sep 2017

I used the windows syntax.
apig-test --username [email protected] --password Passw0rd! --user-pool-id us-east-1_TXj0SxE --app-client-id 3201ojaiiav0k0p5ais0op3m --cognito-region us-east-1 --identity-pool-id us-east-1:c3c3e453-c386-4e59-b689-525bebc07 --invoke-url https://knl827x1si.execute-api.us-east-1.amazonaws.com/prod --api-gateway-region us-east-1 --path-template notes --method POST --body "{\"content\":\"hello world\",\"attachment\":\"hello.jpg\"}"

nvamshik on 23 Sep 2017

@nvamshik I'm not sure if it's a typo but the --path-template that we use in the tutorial is /notes not notes.

jayair on 24 Sep 2017

I also get IdentityPool not found

Authentication is fine:

➜  serverless-stack-demo-api git:(master) ✗ apig-test \
--username='[email protected]' \ 
--password='Passw0rd!' \ 
--user-pool-id='eu-west-2_achS8baFu' \
--app-client-id='6o3iivoaqbslnqatt46jche42e' \
--cognito-region='eu-west-2' \ 
--identity-pool-id='us-west-2:55f8e2df-7e47-4120-bdc0-843f2974f63b' \
--invoke-url='https://y85xk63wnk.execute-api.eu-west-2.amazonaws.com/prod' \
--api-gateway-region='eu-west-2' \
--path-template='/notes' \
--method='POST' \
--body='{"content":"hello world","attachment":"hello.jpg"}'
Authenticating with User Pool
Getting temporary credentials
IdentityPool 'us-west-2:55f8e2df-7e47-4120-bdc0-843f2974f63b' not found.

On AWS my pool is:

us-west-2:55f8e2df-7e47-4120-bdc0-843f2974f63b

arn:aws:cognito-identity:us-west-2:180971085012:identitypool/us-west-2:55f8e2df-7e47-4120-bdc0-843f2974f63b

Do pools and Identities need to be in the same region?

quantuminformation on 26 Sep 2017

I moved the Id pool to eu-west-2 and new error: Invalid identity pool configuration. Check assigned IAM roles for this pool. I will investigate and report back

quantuminformation on 26 Sep 2017

this is my permissions for the role assigned to this Id pool:

quantuminformation on 26 Sep 2017

@QuantumInformation Can you following the steps in this comment (https://github.com/AnomalyInnovations/serverless-stack-com/issues/112#issuecomment-317204545) to see what the policy is for your Identity Pool?
And post it here.

jayair on 27 Sep 2017

Sure
The Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*",
                "cognito-identity:*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::notes-testtut/${cognito-identity.amazonaws.com:sub}*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "execute-api:Invoke"
            ],
            "Resource": [
                "arn:aws:execute-api:eu-west-2:*:y85xk63wnk/*"
            ]
        }
    ]
}

I tested the policy against the s3 bucket, but it said access is denied:

The bucket exists: http://notes-testtut.s3.amazonaws.com/
I checked the policy for the api and it has access.

quantuminformation on 27 Sep 2017

@QuantumInformation I might be a little confused here, so your React app is able to make requests to your API but you are not able to upload files to S3?

jayair on 28 Sep 2017

@jayair - I think some of these 403 and 500 errors are related to having aws profiles different than the default profile. I've redone this backend for the 3rd time today. First 2 goes I was not using the default profile in aws. This last time I set the aws configuration as the default. This time I didn't have a problem.

I hope this helps someone. Great tutorial really learning incredible amounts.

clarkgrg on 29 Sep 2017

👍1

So the error I was having was due to the role not having the correct trusted entity or smth.