SAM Doctor

ERROR REFERENCE

API Gateway needs endpoint access mode

Endpoint access mode is required for the specified security policy means API Gateway rejected an enhanced SecurityPolicy_* without an explicit endpoint access mode. This is a template or transformed-resource mismatch, not an IAM denial.

WHAT IT MEANS

The TLS policy and endpoint mode must be declared together

Resource handler returned message: "Endpoint access mode is required for the specified security policy (Service: ApiGateway, Status Code: 400)"

API Gateway treats policies beginning with SecurityPolicy_ as enhanced security policies. A REST API or custom domain using one must also declare EndpointAccessMode, either directly on the resource or through the supported OpenAPI extension.

NEXT CHECK

Set the access mode on the resource that owns the policy

  1. Find the policy. Check the SAM or CloudFormation resource and confirm whether SecurityPolicy starts with SecurityPolicy_; also check a custom-domain resource if the policy is attached there.
  2. Declare the mode: 
    EndpointAccessMode: BASIC  # or STRICT, chosen for the intended traffic model
SecurityPolicy: SecurityPolicy_TLS13_1_2_2021_06
    Use the equivalent property on AWS::Serverless::Api, AWS::ApiGateway::RestApi, or the relevant domain resource.
  3. Verify the transformed definition. Run sam build and inspect the generated CloudFormation or OpenAPI; if the API is OpenAPI-defined, preserve x-amazon-apigateway-endpoint-access-mode. Do not change IAM for this validation error.

AUTOMATE THE TRIAGE

Keep the handoff in your normal workflow

SAM Doctor recognizes this API Gateway validation marker with high confidence and points at the resource property that needs inspection. It runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED