# Debugging API Gateway

**URL:** <https://discourse.sst.dev/t/debugging-api-gateway/2011>\
**Category:** Chapter Comments\
**Created:** [August 8, 2020, 10:42pm UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011 "2020-08-08T22:42:05Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sjd996](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sjd996](https://discourse.sst.dev/u/sjd996)\
**Post date:** [August 8, 2020, 10:42pm UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011/1 "2020-08-08T22:42:05Z")

</div>

So up until now, have been following and everything is working flawlessly, until I get to:

> **[Test the APIs](https://serverless-stack.com/chapters/test-the-apis.html)**
>
> To test a serverless backend API secured using IAM and Cognito User Pool you need to follow a few steps. First, generate a user token by authenticating with the User Pool. Then use the user token to get a set of temporary IAM credentials using the...

Specifically running the npx command I get:

npx: installed 106 in 9.605s

Authenticating with User Pool  
Getting temporary credentials  
Making API request  
{ status: 403,  
statusText: ‘Forbidden’,  
data: { message: ‘Forbidden’ } }

Playing round with the URL (like adding a ‘/’ at the end) I can change that to a 404, but that’s it.

So diving into this page:

> **[API Gateway and Lambda Logs](https://serverless-stack.com/chapters/api-gateway-and-lambda-logs.html#enable-api-gateway-cloudwatch-logs)**
>
> To view logs for your serverless APIs on AWS, CloudWatch needs to be enabled for API Gateway and Lambda. CloudWatch logs are ordered by Log Groups and Log Stream. Lambda CloudWatch logs can also be viewed using the Serverless CLI with the “serverless...

Follow the steps, go into the AWS console, I can find the API-Gateway-Execution-Logs\_xxxxxx log group that I created. However the page above says there should be 300 streams, however mine shows ‘There are no log streams.’.

Running the npx command again does not create any. I tried creating one manually, but it stays empty.

I’ve gone back over the previous chapters and verified everything (either that or missed a step twice), and googled at length, but I’m stuck - what can I look at/how can I debug this without logs?

---

<div class="post-metadata">

**Author:** ![sjd996](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sjd996](https://discourse.sst.dev/u/sjd996)\
**Post date:** [August 9, 2020, 8:36pm UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011/2 "2020-08-09T20:36:16Z")

</div>

More info: Fired up postman, postman can connect successfully using the master AWS creds to the endpoint. This also generates log entries in CloudWatch;

So this appears to be a credential/access problem? About to go through the Cognito pages again and make sure I didn’t miss anything.

---

<div class="post-metadata">

**Author:** ![sjd996](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sjd996](https://discourse.sst.dev/u/sjd996)\
**Post date:** [August 10, 2020, 8:00pm UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011/3 "2020-08-10T20:00:54Z")

</div>

Still stuck…

Policy simulator shows ‘allowed’ if I use the full arn that matches the resource in the policy, ‘denied’ if I leave the resource at the default ‘\*’

Anyone?

---

<div class="post-metadata">

**Author:** ![sjd996](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sjd996](https://discourse.sst.dev/u/sjd996)\
**Post date:** [August 10, 2020, 8:29pm UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011/4 "2020-08-10T20:29:31Z")

</div>

Well, it’s working finally! Don’t know what the original cause was. However as part of trouble shooting I created a second app client id; with everything else I tweaked, deleting that and everything started working…

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [August 11, 2020, 1:14am UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011/5 "2020-08-11T01:14:14Z")

</div>

Glad you figured it out. Which steps did you redo?

---

<div class="post-metadata">

**Author:** ![sjd996](https://avatars.discourse-cdn.com/v4/letter/s/ecd19e/32.png) [@sjd996](https://discourse.sst.dev/u/sjd996)\
**Post date:** [August 11, 2020, 5:36pm UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011/6 "2020-08-11T17:36:35Z")

</div>

all of them ☹

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [August 24, 2020, 12:17am UTC](https://discourse.sst.dev/t/debugging-api-gateway/2011/7 "2020-08-24T00:17:31Z")

</div>

Wow. That’s a terrible experience.