Using proxy with AWS Lambda Serverless Application Model (SAM)

cloudformation-lambda-serverless-proxy-template.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Example for a SAM Lambda function using {proxy+}.

Resources:

  # Unfortunately, if you leave out the AWS::Lambda::Permission resource, the Api Gateway can't invoke your Lambda function, because
  # the conversion of the 'Events:' section of 'ProxyTest' is missing to set the right permission.
  # Resources to this problem:
  # https://github.com/awslabs/serverless-application-model/issues/148
  # http://www.1strategy.com/blog/2017/06/06/how-to-use-amazon-api-gateway-proxy/

  ProxyPermissions:
      Type: AWS::Lambda::Permission
      DependsOn:
        - ProxyTest
      Properties:
        Action: lambda:InvokeFunction
        FunctionName: !Ref ProxyTest
        Principal: apigateway.amazonaws.com

  ProxyTest:
    Type: AWS::Serverless::Function
    Properties:
      Handler: de.sebastianhesse.examples.aws.ProxyTest
      Runtime: java8
      Timeout: 10
      CodeUri: target/example.jar
      Policies:
        - AWSLambdaBasicExecutionRole
      Events:
        ProxyRest:
          Type: Api
          Properties:
            Path: /foo/{proxy+}
            Method: any

Short update: Figured out that the permission problem only exists if you're calling the Lambda directly through Api Gateway (e.g. using the Api Gateway UI in AWS Console). If you're calling the Lambda via https://{stage}.execute-api.us-east-1.amazonaws.com/Prod/foo/123 it's working fine without adding the extra permission.