Return 404 instead of 403

[jledesma-opsguru]

Hi all.

As you know, API Gateway returns 403 when a non-existent method is called. This is a bit against the standards. I've been researching the issue, but couldn't find a way to fix it. I wanted to ask you if using SAM, you can create a mock response to return a 404 only in case the method or path does not exist so that it still returns 403 when there is an authentication error. I tried the following, but I still got 403:

MyApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      Name: SAAS APIs
      TracingEnabled: true
      StageName: !Ref Environment
      GatewayResponses:
        BAD_REQUEST_BODY:
          ResponseTemplates:
            "application/json": '{"description": "$context.error.validationErrorString"}'

ProxyResource:
    Type: 'AWS::ApiGateway::Resource'
    Properties:
      ParentId: !GetAtt MyApiGateway.RootResourceId
      PathPart: "{proxy+}"
      RestApiId: !Ref MyApiGateway

  ProxyMethod:
    Type: 'AWS::ApiGateway::Method'
    Properties:
      HttpMethod: ANY
      ResourceId: !Ref ProxyResource
      RestApiId: !Ref MyApiGateway
      AuthorizationType: NONE
      Integration:
        Type: MOCK        
        IntegrationResponses:
          - StatusCode: '404'
            ResponseTemplates:
              application/json: "{\"message\": \"Not Found\"}"
      MethodResponses:
        - StatusCode: '404'

[jledesma-opsguru]

Any comments on this one? Maybe @moelasmar?

[moelasmar]

can you give more context, are you facing this issue when you try sam local start-api ?

[jledesma-opsguru]

Hi @moelasmar . I'm having the same behaviour on my local (using sam local start-api) and also when the API is deployed on AWS.

[MohiuddinSumon]

say you have a GET:/country/name endpoint if you call GET:/county/name you should get 404 but Api Gateway actually returns 403 and error text. Most of the cases you will not want to expose those errors OR this behavior. Is there any fix for it ? Thanks