title: AWS API Gateway and Lambda function deployed through terraform -- Execution failed due to configuration error: Invalid permissions on Lambda function
body: <p>I'm deploying an API gateway and a Lambda function together through Terraform, and the Lambda function is meant to be triggered by the API Gateway. After the resources successfully deploy, I test the API Gateway and I get response: </p>
  
  <blockquote>
    <p>{
      "message": "Internal server error"
    }
    .</p>
  </blockquote>
  
  <p>The actual logs of the API gateway say:</p>
  
  <blockquote>
    <p>Execution failed due to configuration error: Invalid permissions on Lambda function</p>
  </blockquote>
  
  <p>I can get the actual api-lambda functionality to work by going to the integration request section of the API gateway, reselecting my existing function, and "saving" it again with the little checkmark, but this breaks automation and I want this to work without having to do that manual step every time. Not sure if this is a bug in Terraform/AWS or if I'm doing something wrong. (Found someone asking the same question but using SAM but no responses: <a href="https://stackoverflow.com/questions/54067224/execution-failed-due-to-configuration-error-invalid-permissions-on-lambda-funct/54835261#54835261">Execution failed due to configuration error: Invalid permissions on Lambda function</a>)</p>
  
  <p>My current setup is deploying the API via a swagger json file, and the Lambda Invoke ARN is used as the URI in the integration section of this file. I have tried switching this between a hard coded ARN and a variable to no avail. I also tried including an aws_api_gateway_deployment and aws_api_gateway_integration resource but I figured that if I'm already using a swagger file, using those would conflict with what the swagger file is already building. </p>
  
  <p>My main.tf for my api_gateway module looks like this:</p>
  
  <pre><code>resource "aws_api_gateway_rest_api" "post_session" {
      name = "${var.api_gateway_name}"
      body = "${data.template_file.post-session.rendered}"
  
      endpoint_configuration {
          types = ["PRIVATE"]
      }
  }
  
  data "template_file" "post-session" {
      template = "${file("../source/aapt-ual-post-session-v1-swagger-apigateway.json")}"
  
      vars {
          session_init_arn = "${var.session_init_function_arn}"
      }
  }
  </code></pre>
  
  <p>My relevant section of the swagger file looks like this:</p>
  
  <pre><code>"x-amazon-apigateway-integration": {
        "uri": "${session_init_arn}",
        "responses": {
          "default": {
            "statusCode": "200"
          }
        },
        "requestTemplates": {
          "application/json":  ....
  </code></pre>
  
  <p>And my lambda_permission/api_gateway trigger section of my Lambda module looks like this:</p>
  
  <pre><code>resource "aws_lambda_permission" "post_session_trigger" {
       statement_id  = "Allow_My_Post_Session_Invoke"
       action        = "lambda:InvokeFunction"
       function_name = "${aws_lambda_function.init_function.function_name}"
       principal     = "apigateway.amazonaws.com"
       source_arn = "arn:aws:execute-api:us-east-1:${var.account_id}:${var.post_session_id}/v1/POST/aa/ual/session"
  
  }
  </code></pre>
  
  <p>Let me know if you have any suggestions, thanks! </p>