IAM user access to manage API

Question

I have been battling this for a while. The user must be able to view, edit and create API's.
I have tried using the AWS Policy Generator to create the following:

```
 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmtxxxxxxxxxxx",
      "Action": "apigateway:*",
      "Effect": "Allow",
      "Resource": "arn:aws:apigateway:us-east/*"
    }
  ]
}
```

Then when testing the policy, I get that my username does not have apigateway: GET rights. What gives?

Accepted Answer

It looks like your resource is not formatted properly -- for instance you don't have a valid region specified in your policy document. us-east is not a valid region. It's also unclear what resource you are trying to declare. To see what the resource specification format should be check out Actions, resources, and condition keys for Amazon API Gateway Management -- particularly the section on the resource specification for RestApis.

It looks like you might need something like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ApiCreateAndEditAccess",
      "Effect": "Allow",
      "Action": [
        "apigateway:*"
      ],
      "Resource": [
        "arn:aws:apigateway:us-east-2::/restapis",
        "arn:aws:apigateway:us-east-2::/restapis/*"
      ],
    }
  ]
}

It looks like you might need something like this:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ApiCreateAndEditAccess",
      "Effect": "Allow",
      "Action": [
        "apigateway:*"
      ],
      "Resource": [
        "arn:aws:apigateway:us-east-2::/restapis",
        "arn:aws:apigateway:us-east-2::/restapis/*"
      ],
    }
  ]
}
```

Answer

Please take a look at this document https://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.html
The section "API Gateway permissions model for creating and managing an API" talks about IAM permissions required to create and manage APIs

IAM user access to manage API

相關內容