CODEWITHSUNDEEP
terraformaws-api-gatewayterraform-provider-aws
bdev03
bdev03

Reputation: 425

Creating an aws_api_gateway_account resource returns AccessDeniedException

In my terraform script I have the following resource -

resource "aws_api_gateway_account" "demo" {
  cloudwatch_role_arn = var.apigw_cloudwatch_role_arn
}

In the Apply stage, I see the following error -

2020/09/21 20:20:48 [ERROR] <root>: eval: *terraform.EvalApplyPost, err: Updating API Gateway Account failed: AccessDeniedException: 
    status code: 403, request id: abb0662e-ead2-4d95-b987-7d889088a5ef

Is there a specific permission that needs to be attached to the role in order to get rid of this error?

Upvotes: 1

Views: 3671

Answers (3)

Pavel Pichrt
Pavel Pichrt

Reputation: 81

Since neither this thread (so far) nor the official documentation is doing a very good job at solving this problem... The minimal policies required for this action are:

{
  "Sid": "AllowPassingTheRoleToApiGateway",
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "iam:PassedToService": ["apigateway.amazonaws.com"]
    }
  }
}

{
  "Sid": "AllowAPIGatewayUpdate",
  "Effect": "Allow",
  "Action": [
      "apigateway:UpdateRestApiPolicy",
      "apigateway:PATCH",
      "apigateway:GET"
  ],
  "Resource": "*"
}

Upvotes: 0

Andy S
Andy S

Reputation: 69

Ran into the same problem as @bdev03, took me 2 days to identify the missing permission is "iam:PassRole", be so good if terraform is able to point that out, hope this helps.

Upvotes: 6

T.H.
T.H.

Reputation: 859

I haven't tested, but I believe the role needs what's shown below. See more context at the source: "To enable CloudWatch Logs" section at https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html

For common application scenarios, the IAM role could attach the managed policy of AmazonAPIGatewayPushToCloudWatchLogs, which contains the following access policy statement:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": "*" } ] }

The IAM role must also contain the following trust relationship statement:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "apigateway.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }

Upvotes: -1

Related Questions