IAM Policy to Deny Specific Routes in WEBSOCKET Api Gateway

Question

I have a Websocket API gateway with the standard $default, $connect, $disconnect route and one admin route. I am using AWS IAM to authorise $connect which is working fine.
I am using Route selection expression: $request.body.group to route to specific routes (e.g. a message like `{"group":"admin"}` will be correctly routed to the POST /admin route.

I now want to add a specific IAM DENY policy which denies access to the /admin route but still allows users to connect and use the $default route, i.e. I want messages including `{"group":"admin"}` to be denied.

I have tried all combinations I could find in the docs and think of around `execute-api:Invoke`,  but none of them have worked. Is what I am trying even possible? I really want to avoid having to use multiple gateways or a lambda authoriser. I have initially been following https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "execute-api:Invoke",
            "Resource": [
                 "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/STAGE/POST/admin",
                 "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/*/admin",
                 "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/*/*/admin",
                 "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/STAGE/POST/admin/*",
        }
    ]
}
```

Any help would be much appreciated!

re:Post Agent · Answer

Yes, it is possible to create an IAM policy to deny access to specific routes in a WebSocket API Gateway while still allowing users to connect and use other routes. However, the ARN format you're using for WebSocket APIs is slightly different from what's required.

For WebSocket APIs, the ARN format for routes is:

arn:aws:execute-api:region:account-id:api-id/stage-name/route-key

In your case, to deny access to the admin route, you would use:

arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/STAGE/admin

Here's an example of an IAM policy that would deny access to the admin route while still allowing access to other routes:

```{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "execute-api:Invoke",
            "Resource": [
                "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/STAGE/$connect",
                "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/STAGE/$disconnect",
                "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/STAGE/$default"
            ]
        },
        {
            "Effect": "Deny",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:REGION:ACCOUNT-ID:API-ID/STAGE/admin"
        }
    ]
}
```

This policy explicitly allows access to the $connect, $disconnect, and $default routes, while denying access to the admin route. The "Deny" statement takes precedence over any "Allow" statements, ensuring that access to the admin route is blocked.

Remember to replace REGION, ACCOUNT-ID, API-ID, and STAGE with your actual values. Also, ensure that IAM authorization is enabled for your WebSocket API routes.

If you're still experiencing issues, double-check that your route selection expression is working correctly and that the admin route is indeed being triggered when the message contains {"group":"admin"}. You might also want to enable CloudWatch logs for your API to help troubleshoot any unexpected behavior.

**Sources**  
[Control access to WebSocket APIs with IAM authorization - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-control-access-iam.html)  
[Control and manage access to WebSocket APIs in API Gateway - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-control-access.html)

IAM Policy to Deny Specific Routes in WEBSOCKET Api Gateway

Add your answer

Relevant content