re-deploying with custom domain name gives "forbidden" error

[SCDealy]

I used undeploy followed by deploy on a site with a custom domain name and AWS certificate, then tried to certify since this changed the Amazon url (which worked with the site) but certify apparently can only be run one time, leaving the custom domain broken (gives the "{message:forbidden}" error) with no obvious way to fix it.

This site uses a domain name managed by a non-AWS provider, but I configured with an AWS certificate.

Site was certified and working with custom domain name for the first time yesterday. The site wasn't working with the custom domain this morning (don't know why). Unable to find a cause and not knowing how the AWS configuration works I tried undeploy then deploy (updating the DNS to point to the new Amazon URL) and then attempted to run certify which threw an exception indicating that it is already certified. After a long period of Amazon education I was able to determine that the "Base Path Mappings" (amazon's console at: "your-region.console.aws.amazon.com/apigateway/", then select "custom domain names" - for those like me who don't know where to do this) was empty and that setting it to:

Path: / Destination: (production-deployment):production

allowed my custom domain to work again.

I am not certain if this is the configuration that is created by Zappa using deploy/certify, only that this works. I am also uncertain as to how/why the site stopped working overnight and if this was the issue then.

Expected Behavior

Zappa should provide some means of verifying that the API gateway configuration is correct/matches the current configuration and updating the API gateway if it isn't correct when the "certify" option is used.

Actual Behavior

Throws exception indicating domain name is already certified

Possible Fix

Ideally zappa would automatically detect the existing configuration and verify that it matches what would otherwise be uploaded. Alternatively add a certify command line option "--update" which would force replacement of any current configuration .

Steps to Reproduce

Starting with a site that has never been deployed:

1. zappa deploy production (then update with amazon generated url)
2. zappa certify production
3. zappa undeploy production
4. zappa deploy production
5. zappa certify production

Your Environment

• Zappa version used: 0.45.1
• Operating System and Python version: Debian Linux (jessie), python 3.6.3
• The output of pip freeze:

pip-freeze.txt

• Link to your project (optional):
• Your zappa_settings.py:

[ghost]

I had the problem of using zappa certify with a custom domain and kept receiving a " {"message":"Forbidden"} " error.

This was solved by going to my aws console and navigating to 'API Gateway'. Under 'Custom Domain Names" find your custom domain. The problem is that it is missing a base path under 'Base Path Mappings'. Follow the steps SCDealy used and your website/apis should work.

A problem when using zappa and custom domains is that zappa creates a cloudfront distribution that is not displayed on the aws console. So deleting the certificate become impossible because it is attached to the distribution. Because of this I lost a domain to because I got so frustrated I closed my aws account and made a new one but my domain did not transfer because it is still stuck with the closed aws account distribution. I am contacting aws support to see what I can do about this.

[glassresistor]

I've gotten this often when I setup and tear down. Usually if i let it sit in around 40min it starts work because as far as i can tell its the DNS updating which API gateway to go to. Since the old one doesn't exist its giving the Forbidden json but its always corrected itself for me.

[SCDealy]

As jaconjcondes mentions, the custom domain is apparently a cloudfront construct, but cloudfront denied that I had any resources, so I wasted hours trying to figure out where/how to view/change this setting. This would seem to me to be an AWS bug since there was a cloudfront ARN but no access through cloudfront.

With regard to glassresistor's comment, my broken configuration was sitting around for hours without correcting, and I don't believe it was possible for it to correct since the base path mapping configuration was actually empty in my case. How it ended up empty, I don't know, however, it had to be due to the action of either Zappa or Amazon, since when I started down this path, I had never accessed the amazon pages which could alter this setting.

[SCDealy]

Having thought about this further, I am convinced that it should be viewed as a bug that Zappa does not undo all the effects of "certify" whenever undeploy is run. Once you undeploy, the url mapping is broken and should be removed.

NOTE: I still think that my recommendation above that zappa verify/update existing configuration when certify is called for an already certified domain (rather than throwing an exception) should also be followed.

[nueverest]

Agree that this is a bug. Zappa should fully deploy and certify the site instead of quietly failing to complete the task.

[hammadzz]

Manual fix for now:

1. Go to AWS CONSOLE > API GATEWAY > CUSTOM DOMAIN NAMES and delete your domain (there should be a cross on top right corner of the card for your domain setup)
2. Run zappa certify on cli

[nickpolet]

Can confirm that I encountered this as well. Not entirely sure that it's a bug with zappa, but I think it should have configured "Base Path Mappings". I think I tried to certify an AWS Certificate, which failed and I ended up getting some strange behaviour after that.

Ended up working out the solution that @hammadzz has posted above. So if anyone see's {'message':'Forbidden'} when trying to access their deployment with a custom domain, the above works.

[scoates]

{"message":"Forbidden"} comes from API Gateway when it has no place to point an event (when there is no base path mapping).

It sounds like there's something up in Zappa when trying to attach to an existing Custom Domain Name, though. Leaving this one open.

[elcolie]

In the addition the manual fix from hammadzz works However, I don't need to remove it just adjust it a bit start from CUSTOM DOMAIN NAMES -> BASE PATH MAPPINGS add path and destination