A developer is debugging an application that uses several Lambda functions which call an API exposed by API Gateway. The API Gateway method uses an Amazon Cognito authorizer. The Lambda functions include the user ID in the Authorization header when calling the API. All GET requests to the API return HTTP 403. How can the developer fix this?

The correct solution is to include a valid Cognito authentication token in the Authorization header. An Amazon Cognito authorizer expects a valid JWT (JSON Web Token) issued by Cognito in the Authorization header to authenticate requests. The problem states the Lambda functions are sending the user ID, which is not a valid authentication token for a Cognito authorizer, leading to a 403 Forbidden error. Changing the client GET request to include a valid API key in the Authorization header is incorrect because an API key is used for API usage plans and throttling, not for authentication with a Cognito authorizer. Updating the API Gateway resource policy to allow execute-api:Invoke action is incorrect because resource policies control access based on source IP or VPC, not user authentication via a Cognito authorizer. Having the client send an OPTIONS preflight request is related to CORS (Cross-Origin Resource Sharing) and is irrelevant to a 403 error caused by an invalid authentication token for a Cognito authorizer.