Does API Gateway behind CloudFront not support AWS_IAM authentication? : <p>It seems that it is impossible to call a REST API that has AWS_IAM protection enabled through a CloudFront Distribution.</p>

<p>Here is how to reproduce this:</p>

<ul>
<li>create a REST API with API Gateway</li>
<li>protect a REST API method with AWS_IAM authentication</li>
<li>create a CloudFront Distribution that targets the REST API</li>
<li>create an A Record in Route 53 that targets the CloudFront Distribution</li>
</ul>

<p>Now use an authenticated user (I use Cognito UserPool user and aws-amplify) to call</p>

<ol>
<li>the protected REST API method with its API Gateway URL = SUCCESS</li>
<li>the protected REST API method via the CloudFront distribution URL = FAILURE</li>
<li>the protected REST API method via the Route 53 domain URL = FAILURE</li>
</ol>

<p>The error I am getting is:</p>

<p>{"message":"The request signature we calculated does not match the signature you provided. Check your AWS Secret Access Key and signing method. Consult the service documentation for details."}</p>

<p>I just can't believe AWS does not support AWS_IAM protected endpoints behind a custom domain since this must be a very very common use-case.</p>

<p>Therefore could you please provide me with a detailed list of how to achieve this?</p>

<p>Thank you</p>
