AWSAPIGatewayClient always results in unauthorised - ios

Question

When using the amazon generated code for AWSAPIGatewayClient I always get
message = Unauthorized;
as a response.
What could be the cause of this?
AppDelegate
AWSCognitoIdentityUserPool *pool = [AWSCognitoIdentityUserPool CognitoIdentityUserPoolForKey:#"UserPool"];
AWSCognitoCredentialsProvider *credentialsProvider = [[AWSCognitoCredentialsProvider alloc] initWithRegionType:AWSRegionUSEast1
identityPoolId:CognitoPoolId
identityProviderManager:pool];
AWSServiceConfiguration *serviceConfiguration = [[AWSServiceConfiguration alloc] initWithRegion:CognitoIdentityUserPoolRegion
credentialsProvider:credentialsProvider];
AWSServiceManager.defaultServiceManager.defaultServiceConfiguration = serviceConfiguration;
AWSCognitoIdentityUserPoolConfiguration *configuration = [[AWSCognitoIdentityUserPoolConfiguration alloc] initWithClientId:CognitoIdentityUserPoolAppClientId
clientSecret:CognitoIdentityUserPoolAppClientSecret
poolId:CognitoIdentityUserPoolId];
[AWSCognitoIdentityUserPool registerCognitoIdentityUserPoolWithConfiguration:serviceConfiguration
userPoolConfiguration:configuration
forKey:#"UserPool"];
ViewController
[[[AWSPrjctRtClient defaultClient] suggestionsGet] continueWithBlock:^id _Nullable(AWSTask * _Nonnull task) {
NSLog(#"%#", task.error);
return nil;
}];
Results in
2017-04-07 16:02:24.386 xxxx[38051:1025018] Error Domain=com.amazonaws.AWSAPIGatewayErrorDomain Code=1 "(null)" UserInfo={HTTPBody={
message = Unauthorized;

Answer 1

The response looks like your API Gateway resource is configured to use Cognito user pools for authorization, but your code actually uses Cognito Federated Identities. In turn, Federated Identities requires API Gateway to use AWS_IAM authorizers, using IAM roles to manage access to your resources.
I would suggest you go through the following steps:
Follow this guide. Basically, within Cognito Federated Identities, configure an Identity Pool to use your User Pool as (one of) its Authentication provider(s). (You may have already done this)
Check the Authorization of your API Gateway resource(s) under Method Requests/Settings/Authorization. Set it to AWS_IAM. Don't forget to redeploy the newly configured API, and export a new SDK.
Your Identity Pool will require two IAM roles, for both unauthenticated and authenticated access to AWS services. You will have to add a policy to your role(s) to specify access to your AWS services, in this case you will need to grant "execute-api:Invoke" access to (presumably only) your authenticated role. I recommend using the policy generator for this, and make sure you get set the ARN for the policy to be only for the resource(s) you want to grant access to, otherwise all of your API Gateway resources may be accessed.
As for configuration on the iOS SDK side, make sure you use the code from the guide (shown below), it seems yours is slightly different. I have found that getting this wrong can induce a whole range of confusing errors that could have you look in all sorts of wrong directions for a solution.
Add to AppDelegate
AWSServiceConfiguration *serviceConfiguration = [[AWSServiceConfiguration alloc] initWithRegion:AWSRegionUSEast1
credentialsProvider:nil];
AWSCognitoIdentityUserPoolConfiguration *userPoolConfiguration = [[AWSCognitoIdentityUserPoolConfiguration alloc] initWithClientId:#"YOUR_CLIENT_ID"
clientSecret:#"YOUR_CLIENT_SECRET"
poolId:#"YOUR_USER_POOL_ID"];
[AWSCognitoIdentityUserPool registerCognitoIdentityUserPoolWithConfiguration:serviceConfiguration
userPoolConfiguration:userPoolConfiguration forKey:#"UserPool"];
AWSCognitoIdentityUserPool *pool = [AWSCognitoIdentityUserPool CognitoIdentityUserPoolForKey:#"UserPool"];
AWSCognitoCredentialsProvider *credentialsProvider = [[AWSCognitoCredentialsProvider alloc]
initWithRegionType:AWSRegionUSEast1
identityPoolId:#"YOUR_IDENTITY_POOL_ID"
identityProviderManager:pool];
One important addition though! I've found this particularly confusing at first, but in the above code you initialize an AWSServiceConfiguration with credentialsProvider set to nil in order to register your AWSCognitoIdentityUserPool. However, you will need to initialize a new AWSServiceConfiguration that references your credentialsProvider to assign to your AWSServiceManager.defaultServiceManager.defaultServiceConfiguration. Like so:
AWSServiceManager.defaultServiceManager.defaultServiceConfiguration = [[AWSServiceConfiguration alloc] initWithRegion:CognitoUserPoolRegion
credentialsProvider:credentialsProvider];
The above described steps ultimately led me to successfully integrating Cognito User Pools with Federated Identities to allow access to API Gateway resources. The process involved some confusion about what services do what exactly, and piecing together pieces of code from different guides. I hope this helps!
Note that you can also probably do without Federated Identities and leave your API to be authorized using the User Pool directly. But I haven't been successful in that approach. Also, Federated Identities will allow you to add other authorizers at a later stage if you please to do so.