title: How to authorise a role to perform "execute-api:Invoke"?
body: <p>I'm attempting to move a suite of end-to-end tests so that they are fully contained within AWS. I've done this through code build and gotten everything running up to the point of running the tests, which invoke an API to reset the database before every test run. I keep running into this error message when the first test attempts to run. </p>
  
  <pre class="lang-js prettyprint-override"><code>StatusCodeError: 403 - "{\"Message\":\"User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:eu-west-2:*:*"}" 
  </code></pre>
  
  <p>At first, I thought the error was being caused by a lack of permissions on the role that was being used to build everything. I tried adding the correct permissions to IAM Role being used, eventual making them more open than I would like. </p>
  
  <pre><code>"Effect": "Allow",
  "Action": [
      "execute-api:Invoke",
      "execute-api:ManageConnections"
  ],
  "Resource": "arn:aws:execute-api:*:*:*"
  </code></pre>
  
  <p>Obviously didn't fix things but I did notice that the access advisor shows that the particular policy isn't being accessed.</p>
  
  <p>Next, I went into the resource policy in API Gateway to see if there was something there. I removed some Ip Address conditions that were set up to restrict access to the office's Ip Addresses. </p>
  
  <p>I've look inside of WAF and Shield and can't see anything that would be related to invoking the API. At this point I am at a lost on where my next investigation should start.</p>
  
  <p><strong><em>Edit</em></strong></p>
  
  <p>Here's the responce I'm getting back.</p>
  
  <pre><code>"requestId": "********-82f8-11e9-a732-0b550cf3fcd6",
  "ip": "*.*.*.*",
  "caller": "-",
  "user": "-",
  "requestTime": "30/May/2019:16:32:50 +0000",
  "httpMethod": "GET",
  "resourcePath": "/*/ref-data/{proxy+}", "status": "403", "protocol": "HTTP/1.1", "responseLength": "185"
  </code></pre>