here is my problem: I have different users that can access an API using IAM authentication. Every user send some data, that have to be put in a kinesis stream. Every user has its own kinesis stream. The gateway put the data on the correct stream based on a "streamName" field present in the request. The stream consumers discard every data eventually put in the wrong stream (for instance in the case "user A" has specified "stream B").
This system is working fine, but it is not efficient.
I would like to enforce the right utilization of the streams to the api gateway level using IAM roles/policies. If every user has a policy that grant him the access only to its kinesis stream, is there a way to configure the system to have the bad requests rejected without the put to the streams are performed?
In other words, I would like to have the API gateway to be granted the access to a particular kinesis stream based on the policy of the caller user.
Thank you for your help. Gabriele
EDIT:
I think I found an hint for the solution. Here: https://docs.aws.amazon.com/apigateway/latest/developerguide/permissions.html
In the light blue box at the and it states: To enact access control to an AWS service, you can use either the caller-based permissions model, where a permissions policy is directly attached to the caller's IAM user or group, or the role-based permission model, where a permissions policy is attached to an IAM role that API Gateway can assume.
I think that the "caller-based permission model" could be the right way to do it.