How to use IAM to secure access to application REST endpoints?

If you place API Gateway in front of your services, you can use API Gateway resource policy to allow access only from specific IAM role https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html#apigateway-resource-policies-cross-account-example

If you just use Beanstalk services, they are running on EC2 instances, so communication between them is regulated only by Security Group (allow or disallow IP addresses). IAM identity checking can not be implemented here by default.

So you have two options:

• using API Gateway in front of your microservices
• develop custom authentication logic on the application side

Hello,

Here's how to troubleshoot the issue of CloudFront in one account accessing content from another account's S3 bucket:

1. Verify IAM Permissions:

Bucket Policy (Account A): Ensure the S3 bucket policy in account A grants access to CloudFront in account B. You'll need to include the CloudFront origin identity as a principal in the policy document. Reference: https://docs.aws.amazon.com/whitepapers/latest/secure-content-delivery-amazon-cloudfront/s3-origin-with-cloudfront.html

IAM Role (Account B):

If using an IAM role with CloudFront, verify the trust policy in account B allows CloudFront to assume the role. Reference: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/security_iam_service-with-iam.html

2. Check CloudFront Origin Settings:

Origin Access Identity (OAI): Ensure the CloudFront distribution in account B has a properly configured OAI. This grants access to the S3 bucket based on the IAM permissions in account A.

3. Review Route 53 Configuration:

Subdomain Routing: Double-check that Route 53 in account A has separate A records or Alias records pointing your desired subdomains to their respective destinations, while the main domain (cloudwatch.com) points to the CloudFront distribution.