title: Is IAM Authentication to API Gateway via Cloudfront possible?
body: <p>Is it possible to use IAM Roles Authentication to an API Gateway endpoint via Cloudfront?</p>
  
  <p>Here is a basic use case:</p>
  
  <ul>
  <li>/api -> API Gateway </li>
  <li>/* -> S3 HTML/Javascript</li>
  </ul>
  
  <p>I've been able to get this working <strong>without</strong> Authentication similar to the following setup:
  <a href="https://www.codeengine.com/articles/process-form-aws-api-gateway-lambda/" rel="noreferrer">https://www.codeengine.com/articles/process-form-aws-api-gateway-lambda/</a></p>
  
  <p><a href="https://stackoverflow.com/questions/32825413/how-do-you-add-cloudfront-in-front-of-api-gateway#32825414">How do you add CloudFront in front of API Gateway</a></p>
  
  <p>Of particular note is to NOT forward the HOST header from Cloudfront...</p>
  
  <p>When I enable IAM Authentication in the API, I receive the following response:</p>
  
  <p>OPTIONS: 200</p>
  
  <p>POST: 403</p>
  
  <blockquote>
    <p>{"message":"The request signature we calculated does not match the
    signature you provided. Check your AWS Secret Access Key and signing
    method. Consult the service documentation for details.\n\nThe
    Canonical String for this request should have
    been\n'POST\n/test/create\n\naccept:application/json\ncontent-type:application/json\nhost:*****.execute-api.ap-****-2.amazonaws.com\nx-amz-date:20170328T044253Z\n\naccept;content-type;host;x-amz-date\na57656a9def890d9de2b637789f7e5917f4b2823765ae0122087d08f89a97380'\n\nThe
    String-to-Sign should have
    been\n'AWS4-HMAC-SHA256\n20170328T044253Z\n20170328/ap-southeast-2/execute-api/aws4_request\ncae7fd6b4cabd593ad2ec6ce7091c94dc8cba306e81da95d567873eea8f981a5'\n"}</p>
  </blockquote>
  
  <p>The host in the Canonical String is that of the API Gateway...</p>