How do I access an API Gateway API from another AWS account?

Resolution

Public API endpoints

You can access API Gateway public endpoints (Regional or edge-optimized) directly from the API stage URL. For example, https://0123456789.execute-api.{region}.amazonaws.com/{stage-name}.

You can also use a custom domain name in a public hosted zone to access API Gateway public endpoints.

For more information, see How can I set up a custom domain name for my API Gateway API?

Private REST API endpoints

You can use an interface VPC endpoint to access private REST API endpoints from your Amazon Virtual Private Cloud (Amazon VPC).

To access a private REST API that's located in another account, edit the resource policy to grant cross-account permissions. You can also use a private custom domain name to associate your VPC endpoint in another account.

For more information, see How do I use an interface VPC endpoint to access an API Gateway private REST API in another account?

Use IAM authentication

Additional configuration is required to access an API Gateway API with cross-account access that uses AWS Identity and Access Management (IAM) authentication. Make sure that the IAM entity in the consumer account has permissions to invoke the API through an identity-based policy.

The IAM role of the source account must be allowed explicit access in the resource policy, such as the following:

REST APIs

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::CONSUMER-ACCOUNT-ID:user/USERNAME",
                    "CONSUMER-ACCOUNT-ID"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": [
                "arn:aws:execute-api:YOUR-REGION:API-OWNER-ACCOUNT-ID:API-ID///*"
            ]
        }
    ]
}

Note: Replace CONSUMER-ACCOUNT-ID, USERNAME, YOUR-REGION, API-OWNER-ACCOUNT-ID, and API-ID with your variables.

For more information, see How do I activate IAM authentication for API Gateway REST APIs?

HTTP APIs

The option to use resource policies to provide IAM authentication for cross-accounts isn't available for API Gateway HTTP APIs.

You can use the sts:AssumeRole API action to assume a role for the HTTP API account. The assumed role provides temporary security credentials that you can use to invoke the HTTP API in another account.

For more information, see How can I provide cross-account IAM authorization for API Gateway HTTP APIs?

Related information

Private REST APIs in API Gateway

Example: Allow roles in another AWS account to use an API