0

I have API Gateway endpoint that calls API on ECS. Endpoint is supposed to receive XML and parse it internally. The problem is no matter what model I used for request body (or even without body defined at all) API GW returns 403 when XML version is present in request.

This one causes API GW to return 403:

<?xml version="1.0" encoding="UTF-8"?>
<billing_info_updated_notification>
  <account>
    test
  </account>
</billing_info_updated_notification>

and this one works (no xml version header):

<billing_info_updated_notification>
  <account>
    test
  </account>
</billing_info_updated_notification>

Any idea how to fix this? The problem is that this is webhook notification so I dont have any control on shape of xml.

2 Answers 2

1

Check your Amazon VPC to confirm if you created an interface VPC endpoint to access a >private API Gateway API. If there's an interface endpoint, see if the private DNS setting is selected.

See Docs

0

The problem was with AWS WAF enabled :(. WAF blocked all requests with body starting with:

<?xml version="1.0" encoding="UTF-8"?>

Disabling WAF "solved" the issue.

1
  • 2
    It is from AWS WAF XSS rule body scanning rule, instead of disabling it, you might want to create a whitelist rule based on certain conditions.
    – James Dean
    Oct 25, 2019 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.