# Logged In & Receive 403 For Get Notes Call

**URL:** <https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917>\
**Category:** General\
**Created:** [March 25, 2019, 6:30pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917 "2019-03-25T18:30:19Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![serverless-stack-usr](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@serverless-stack-usr](https://discourse.sst.dev/u/serverless-stack-usr)\
**Post date:** [March 25, 2019, 6:30pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/1 "2019-03-25T18:30:19Z")

</div>

I’ve created the client app and the API. The client app is deployed to:

[https://dev.cakebook.co](https://dev.cakebook.co)

However, after I log in using:

[admin@example.com](mailto:admin@example.com)  
Passw0rd!

I get a 403 response:

message: “User: arn:aws:sts::154716048766:assumed-role/cakebook-api-dev-CognitoAuthRole-1DTRT5XGEGRXW/CognitoIdentityCredentials is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:us-east-2:\*\*\*\*\*\*\*\*8766:sss6l7svxc/dev/GET/orders”

For the API call:

[https://api.cakebook.co/dev/orders](https://api.cakebook.co/dev/orders)

Perhaps my Cognito user does not have permission to call the Lambda (or API gateway)?

I can’t see what step I’ve missed in the tutorials for this to happen. Can someone please help?

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [April 6, 2019, 10:27pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/2 "2019-04-06T22:27:21Z")

</div>

Have you tested the API through the CLI?

> **[Test the APIs](https://serverless-stack.com/chapters/test-the-apis.html)**
>
> To test a serverless backend API secured using IAM and Cognito User Pool you need to follow a few steps. First, generate a user token by authenticating with the User Pool. Then use the user token to get a set of temporary IAM credentials using the...

---

<div class="post-metadata">

**Author:** ![serverless-stack-usr](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@serverless-stack-usr](https://discourse.sst.dev/u/serverless-stack-usr)\
**Post date:** [April 7, 2019, 3:20pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/3 "2019-04-07T15:20:05Z")

</div>

Yeah I’ve tested it through CLI and it works fine.

```auto
➜ cakebook-api git:(master) ✗ npx aws-api-gateway-cli-test \
--username='admin@example.com' \
--password='Passw0rd!' \
--user-pool-id='us-east-2_gyMzxqXfM' \
--app-client-id='2qsrr2frnp2p60u7me94o5tas' \
--cognito-region='us-east-2' \
--identity-pool-id='us-east-2:d9e4e505-c64a-4836-8e56-3af843dbe453' \
--invoke-url='https://w5o4vxx4f0.execute-api.us-east-2.amazonaws.com/dev' \
--api-gateway-region='us-east-2' \
--path-template='/orders' \
--method='GET'
npx: installed 106 in 3.005s
Authenticating with User Pool
Getting temporary credentials
Making API request
{ status: 200,
  statusText: 'OK',
  data:
   [ { attachment: 'hello.jpg',
       content: 'hello world',
       createdAt: 1554649942422,
       noteId: '8b2fb360-5947-11e9-9178-8f9047228302',
       userId: 'us-east-2:f59661aa-0d6e-4d60-9d1a-70a0d3e3dde4' } ] }

```

There’s some more information over on the Stack Overflow question:

> <https://stackoverflow.com/questions/55482627/aws-cognito-user-cannot-invoke-lambda-403-not-authorized>

If you have any other ideas, I’d really appreciate it thanks.

---

<div class="post-metadata">

**Author:** ![serverless-stack-usr](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@serverless-stack-usr](https://discourse.sst.dev/u/serverless-stack-usr)\
**Post date:** [April 7, 2019, 3:21pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/4 "2019-04-07T15:21:33Z")

</div>

When I replace the API Gateway URL in the above command with `https://api.cakebook.co/dev`, I get the 403. So it looks like the problem is in the setup of that URL.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [April 11, 2019, 11:42pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/5 "2019-04-11T23:42:52Z")

</div>

Did you resolve this?

---

<div class="post-metadata">

**Author:** ![serverless-stack-usr](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@serverless-stack-usr](https://discourse.sst.dev/u/serverless-stack-usr)\
**Post date:** [April 12, 2019, 10:24am UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/6 "2019-04-12T10:24:15Z")

</div>

No, but it’s no longer blocking me as I can use the generated API Gateway URL instead. The 403 happens when I try to set the custom domain ([api.cakebook.co](http://api.cakebook.co)) up for the API. There’s something wrong with the configuration of this, perhaps something to do with the SSL certificate. When configuring the ACM cert for the custom domain, I have several certs to choose from. One of them is on “.cakebook.co” which produces an error when I try to do the GET. That error states that the cert does not have the right domain. I have two other certs, both on [api.cakebook.co](http://api.cakebook.co). Both of these produce the 403 result.

---

<div class="post-metadata">

**Author:** ![sobhanniroula](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/sobhanniroula/32/540_2.png) [@sobhanniroula](https://discourse.sst.dev/u/sobhanniroula)\
**Post date:** [July 23, 2019, 8:54pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/7 "2019-07-23T20:54:50Z")

</div>

I also had the same problem. The app threw me Error code 403 when logged in, but I figured it out. My mistake was to write “us-east-1” as API region and DynamoDB region in serverless.yml file while my API region and database were in “us-east-2”. I think you also have the similar problem and hope it sloves your problem too.  
Remeber to deploy your serverless app and check if it creates a new API Gateway. If it does, then you have to create a new Identity Pool, or add a new authentication role in your old Identity Pool.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [July 24, 2019, 10:57pm UTC](https://discourse.sst.dev/t/logged-in-receive-403-for-get-notes-call/917/8 "2019-07-24T22:57:24Z")

</div>

That makes sense. Thanks for sharing!