Error reason: The ARN isn't valid. Failing to construct the correct ARN string of my REST API for my CfnWebACLAssociation function

0

I can see in the AWS Console that the ARN for the REST endpoints being created in the API Gateway have the pattern:

arn:aws:execute-api:us-east-1:553710216655:2hi1wdf6j2/*/OPTIONS/users/*

and my string construction is like so:

const apiArn = `arn:aws:execute-api:${this.region}:${this.account}:${api.restApiId}/*/*/*`;

I'm using ///* because I want to be able to have multiple endpoints in the API.

Also I'm creating the API using the apigateway.LambdaRestApi(...) function so I know I'm creating a REST API and not an HTTP API.

I've also tried formatArn() with no avail:

const apiArn = this.formatArn({
  service: 'execute-api',
  resource: `${api.restApiId}`,
  resourceName: '*/*/*',
  arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
});
2 回答
0
已接受的回答

Solution: the issue was that for a WAF association with an API Gateway we need to associate with the API Stage, not individual endpoints. The stage ARN as @MikelDelTio mentioned is of the format: arn: partition :apigateway: region ::/restapis/ api-id /stages/ stage-name. I kept trying to hook it up per endpoint which has the format: arn:partition:execute-api:region:account-id:api-id/stage/http-method/resource-path.

已回答 7 个月前
0

Hi,

According to the CDK documentation, the ARN must be in the following format for the Amazon API Gateway REST API: arn: *partition* :apigateway: *region* ::/restapis/ *api-id* /stages/ *stage-name*. Could this be the problem?

profile picture
专家
已回答 7 个月前
  • I did double check that: I wonder if the doc is outdated. Because when I created a dummy REST API on API Gateway(using the TS CDK function LambdaRestApi(...)) just to see what the ARN would look like it came out to be of the format:

    arn:aws:execute-api:us-east-1:ACC_ID:2hi1wdf6j2//OPTIONS/users/

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则