Getting error on Appsync websocket connection: You are not authorized to make this call


You are not authorized to make this call

I am trying to create aws appsync subscription with IAM auth. **I am able to query/mutation the appsync with the same IAM credentials,** but getting the exception on websocket connection.

```
import { Sha256 } from '@aws-crypto/sha256-js';
import { HttpRequest } from '@aws-sdk/protocol-http';
import { SignatureV4 } from '@aws-sdk/signature-v4';

const createWSSUrl = async (signer, request) => {
let headerString = "";
// Sign the request asynchronously
return signer.sign(request).then((signedRequest) => {
// Create the URL with the signed headers (base64-encoded)
headerString = Buffer.from(JSON.stringify({
host: signedRequest.headers.host,
'x-amz-date': signedRequest.headers['x-amz-date'],
Authorization: signedRequest.headers['Authorization'],
})).toString('base64');

console.log('Signed headers:', signedRequest.headers);

console.log('Header String (base64-encoded):', headerString);

// Construct the WebSocket URL after signing is complete
const wssURL = `wss://xxxxxxxxxxxxxxxxxxx.appsync-realtime-api.us-east-1.amazonaws.com/graphql?header=${headerString}&payload=e30=`;

return wssURL; // Return the WebSocket URL
})
};

export const auth = async () => {
const endpoint = new URL('https://xxxxxxxxxxxxxxxxxxxxxxx.appsync-api.us-east-1.amazonaws.com/graphql/connect');

const credentials = {
accessKeyId: 'xxxxxxxxxxxxxxxxxxxxxxx',
secretAccessKey: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
}

const signer = new SignatureV4({
region: 'us-east-1',
service: 'appsync',
credentials,
sha256: Sha256
});

const request = new HttpRequest({
url: endpoint,
method: 'POST',
data: "{}",
headers: {
"accept": "application/json, text/javascript",
"content-encoding": "amz-1.0",
"content-type": "application/json; charset=UTF-8",
host: endpoint.host,
}
});

createWSSUrl(signer, request).then((wssURL) => {
console.log('WebSocket URL:', wssURL);
const ws = new WebSocket(wssURL, ["graphql-ws"]);

ws.onopen = (event) => {
console.log('WebSocket connected:', event);
ws.send(
JSON.stringify({
type: 'connection_init',
}));
};
ws.onmessage = (event) => {
console.log('Received message:', event.data);
};
ws.onerror = (error) => {
console.error('WebSocket error:', error);
};
// Handle connection close
ws.onclose = (event) => {
console.log('WebSocket connection closed:', event);
};
}).catch((err) => {
console.error('Error creating WSS URL:', err);
});
}
```

Start with the createWSSUrl and auth entry points in the issue, then inspect how the signed request, encoded headers, endpoint, and WebSocket connection are constructed. Compare the IAM signing and AppSync subscription requirements, and verify the result by establishing the connection without the authorization error.

Written by the indexing model from the issue text.