ios - AWSAPIGatewayClient always results in unauthorised -

when using amazon generated code awsapigatewayclient

message = unauthorized;

as response.

what cause of this?

appdelegate

awscognitoidentityuserpool *pool = [awscognitoidentityuserpool cognitoidentityuserpoolforkey:@"userpool"]; awscognitocredentialsprovider *credentialsprovider = [[awscognitocredentialsprovider alloc] initwithregiontype:awsregionuseast1                                                                                                 identitypoolid:cognitopoolid                                                                                        identityprovidermanager:pool];  awsserviceconfiguration *serviceconfiguration = [[awsserviceconfiguration alloc] initwithregion:cognitoidentityuserpoolregion                                                                             credentialsprovider:credentialsprovider]; awsservicemanager.defaultservicemanager.defaultserviceconfiguration = serviceconfiguration;  awscognitoidentityuserpoolconfiguration *configuration = [[awscognitoidentityuserpoolconfiguration alloc] initwithclientid:cognitoidentityuserpoolappclientid                                                                                                               clientsecret:cognitoidentityuserpoolappclientsecret                                                                                                                     poolid:cognitoidentityuserpoolid]; [awscognitoidentityuserpool registercognitoidentityuserpoolwithconfiguration:serviceconfiguration                                                        userpoolconfiguration:configuration                                                                       forkey:@"userpool"]; 

viewcontroller

[[[awsprjctrtclient defaultclient] suggestionsget] continuewithblock:^id _nullable(awstask * _nonnull task) {          nslog(@"%@", task.error);         return nil; }]; 

results in

2017-04-07 16:02:24.386 xxxx[38051:1025018] error domain=com.amazonaws.awsapigatewayerrordomain code=1 "(null)" userinfo={httpbody={ message = unauthorized; 

the response looks api gateway resource configured use cognito user pools authorization, code uses cognito federated identities. in turn, federated identities requires api gateway use aws_iam authorizers, using iam roles manage access resources.

i suggest go through following steps:

1. follow this guide. basically, within cognito federated identities, configure identity pool use user pool (one of) authentication provider(s). (you may have done this)

2. check authorization of api gateway resource(s) under method requests/settings/authorization. set aws_iam. don't forget redeploy newly configured api, , export new sdk.

3. your identity pool require 2 iam roles, both unauthenticated , authenticated access aws services. have add policy role(s) specify access aws services, in case need grant "execute-api:invoke" access (presumably only) authenticated role. recommend using policy generator this, , make sure set arn policy resource(s) want grant access to, otherwise of api gateway resources may accessed.

4. as configuration on ios sdk side, make sure use code guide (shown below), seems yours different. have found getting wrong can induce whole range of confusing errors have in sorts of wrong directions solution.

add appdelegate

awsserviceconfiguration *serviceconfiguration = [[awsserviceconfiguration alloc] initwithregion:awsregionuseast1                                                                             credentialsprovider:nil]; awscognitoidentityuserpoolconfiguration *userpoolconfiguration = [[awscognitoidentityuserpoolconfiguration alloc] initwithclientid:@"your_client_id"                                                                                                                       clientsecret:@"your_client_secret"                                                                                                                             poolid:@"your_user_pool_id"]; [awscognitoidentityuserpool registercognitoidentityuserpoolwithconfiguration:serviceconfiguration                                                        userpoolconfiguration:userpoolconfiguration forkey:@"userpool"]; awscognitoidentityuserpool *pool = [awscognitoidentityuserpool cognitoidentityuserpoolforkey:@"userpool"]; awscognitocredentialsprovider *credentialsprovider = [[awscognitocredentialsprovider alloc]                                                       initwithregiontype:awsregionuseast1                                                       identitypoolid:@"your_identity_pool_id"                                                       identityprovidermanager:pool]; 

one important addition though! i've found particularly confusing @ first, in above code initialize awsserviceconfiguration credentialsprovider set nil in order register awscognitoidentityuserpool. however, need initialize new awsserviceconfiguration references credentialsprovider assign awsservicemanager.defaultservicemanager.defaultserviceconfiguration. so:

awsservicemanager.defaultservicemanager.defaultserviceconfiguration = [[awsserviceconfiguration alloc] initwithregion:cognitouserpoolregion                                                                                                   credentialsprovider:credentialsprovider]; 

the above described steps led me integrating cognito user pools federated identities allow access api gateway resources. process involved confusion services exactly, , piecing pieces of code different guides. hope helps!

note can without federated identities , leave api authorized using user pool directly. haven't been successful in approach. also, federated identities allow add other authorizers @ later stage if please so.