If you’re working with API Gateway and Lambda authorizers across different AWS accounts, you might encounter a common issue: stage variables are not supported in Lambda authorizer ARNs for cross-account setups. This is a known limitation of API Gateway which can cause confusion, especially because stage variables are resolved at runtime in Lambda URIs. However, ARNs for authorizers are checked during configuration time, before any stage variables can be substituted, leading to errors like “Invalid function ARN” or “Invalid URI.”
Here’s how you can get around this problem:
One simple solution is to avoid using stage variables at all. Instead, specify the full ARN of the Lambda function directly in the authorizer configuration. For example, use the full ARN like:
arn:aws:lambda:us-east-1:ACCOUNT_ID:function:my-authorizer-function
This way, API Gateway has all the necessary information upfront and doesn’t need to resolve any variables at runtime.
Another option is to use Lambda aliases instead of stage variables. Aliases point to specific versions of your Lambda function, making it easier to manage different environments like development or production. You can assign an alias such as “prod” or “dev” and reference it directly in the ARN, like:
arn:aws:lambda:us-east-1:ACCOUNT_ID:function:my-authorizer-function:prod
This approach helps keep your configurations clear, manageable, and compatible across accounts.
If you want to keep the flexibility of staging but still face this cross-account ARN limitation, you can deploy a small wrapper Lambda function within the same account as API Gateway. This wrapper acts as a proxy, forwarding authorization requests to the cross-account Lambda function. It’s like creating a local gateway in the same account, which allows you to use stage variables normally. Remember that the cross-account Lambda function must have a resource-based policy that grants invocation permissions to your wrapper Lambda.
Following these steps can help you set up cross-account Lambda authorizers smoothly, avoiding common configuration pitfalls. For more details, refer to the official AWS API Gateway documentation on Lambda authorizers.