Search code examples
amazon-web-servicesapissldnsgateway

403 Forbidden on API Gateway with Custom domain's aditional domain

I have a REST API serving behind API Gateway.

I have a Route53-hosted zone: myAWSHostedDomain.myCompanyDomain.com

I have also created a certificate in ACM: myApp.myAWSHostedDomain.myCompanyDomain.com

The certificate has an additional domain: myApp.myCompanyDomain.com

The cert has been issued without any problem, both domains were validated. In the company non-AWS-hosted zone myCompanyDomain.com, I have a CNAME pointing myApp to myApp.myAWSHostedDomain.myCompanyDomain.com. It resolves OK.

I have configured a Custom Domain for that API Gateway using that certificate. The name that shows is myApp.myAWSHostedDomain.myCompanyDomain.com. Which is fine because it's the main domain for that cert.

The problem I have is that all the requests made to myApp.myCompanyDomain.com fail with a 403 Forbidden error, while those same requests on the myApp.myAWSHostedDomain.myCompanyDomain.com work just fine. The app code has nothing to do with it, a request for a favicon.ico behaves the same way.

The API Gateway endpoint is configured as a Regional one.

Could it be that API Gateway's custom domain only takes the main domain from the certificate and doesn't work with the additional ones? Is there a way to fix this?

Solution

  • So, the problem is that the request fails with a 403 forbidden error, because API Gateway is unable to set the correct Host header, which is required for the request to succeed.

    If I do:

    curl https://myApp.myCompanyDomain.com/favicon.ico -H "Host:myApp.myAWSHostedDomain.myCompanyDomain.com"

    Then, it works.

    Hence, the options here are the following:

    1. Create a DNS record in Route53 for myApp.myCompanyDomain.com.
    2. While calling the API, add a Host header to the request, with the value set as the value for the DNS record.
    3. Create a new API Gateway where the main custom domain corresponds with the one in the API Gateway: myApp.myCompanyDomain.com work instead of myApp.myAWSHostedDomain.myCompanyDomain.com work.