What is difference between the below mentioned IAM policies?

user_13886119 0
Viewed 161

These are the policies attached to Lambda function calling a REST API in API Gateway. I am trying to understand why we need to have two policies like this, e.g. can somebody explain in simple words what does the first policy do? Why we cannot limit everything with the second policy only? If we only need to allow POST to every path under a particular API what else is required? What is difference between "execute-api" resource and "apigateway"?


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "execute-api:Invoke"           
      ],
      "Resource": [
        "arn:aws:execute-api:us-east-1:account-id:api-id/*/GET/pets"
      ]
    }
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "apigateway:POST"
      ],
      "Resource": [
        "arn:aws:apigateway:us-east-1:account-id:api-id/*"
      ]
    }
}
aws-api-gateway amazon-iam amazon-web-services api
1 Answers

There are two types of permissions for API gateway:

  1. For invoking an API. Your first statement allows invoking the API.
  2. For creating and managing an API. Your second statement allows for creating child resources in the API.

You have two policies, because your resources are different for each statement. So your function can both manage the API and invoke it as well.

user_2488230
Related