Note: This section focuses on controlling who can manage Amazon API Gateway APIs and related resources (control plane). For API access control (data plane) see the documentation.

API management access

Access to the individual API management is controlled, as for any other AWS resource, by AWS Identity and Access Management (IAM). You can explicitly allow actions on the API by granting permissions on RestApi resource. The following policy explicitly allows all actions on the REST API with ID abcd123456 in us-east-1 Region, along with API sub-resources such as stages, deployments, authorizers, request validators, etc.:

{
"Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAllActions",
      "Effect": "Allow",
      "Action": [
        "apigateway:*"
      ],
      "Resource": [
        "arn:aws:apigateway:us-east-1::/restapis/abcd123456/*"
      ]
    }
  ]
}

This policy does not grant access to the custom domains, client certificates, VPC links, API keys, or usage plans. It also does not explicitly allow management of other APIs. Because an IAM principal is denied access by default, they must be explicitly allowed to perform an action. See documentation for more details on implicit and explicit denies and list of resource types in API Gateway management.

Access to the observability information

Access to the observability tools and data should be limited in a similar way you control access to the API management. Access control details depend on data type and storage/destination. Amazon CloudWatch has various features to help gain insights using logs, metrics, and traces. See overall Identity and access management for Amazon CloudWatch and documentation of individual features you may use (dashboards, integrations, contributor insights, etc.), in addition to the information linked below.

Execution logs

API Gateway execution logs are delivered to CloudWatch Logs. See CloudWatch Logs service documentation on how to use IAM for access control. CloudWatch Logs allow streaming data to OpenSearch service or exporting to S3. In these cases, see relevant service documentation on how to control access to the data.

Note that execution logs may include full request and response data. Safeguard sensitive data ingested by CloudWatch Logs by using log group data protection policies. These policies let you audit and mask sensitive data that appears in log events ingested by the log groups in your account.

Access logs

API Gateway access logs are delivered to CloudWatch Logs or Amazon Data Firehose. See service documentation on how to use IAM for access control to control access to CloudWatch Logs. When when you use Firehose to deliver logs, you must implement access control at both Firehose (see documentation) and the destination. As Firehose supports multiple destination types, including external systems, consult relevant service documentation for more information on access management.

Note that access logs may include sensitive information. Safeguard what's ingested by CloudWatch Logs by using log group data protection policies. These policies let you audit and mask sensitive data that appears in log events ingested by the log groups in your account.

Metrics

See service documentation for more information on how to control access to CloudWatch Logs. Note, that metrics may be streamed to other systems so make sure to implement access controls in those systems following their guidelines.

Traces

API Gateway uses AWS X-Ray to collect traces. For information on how to control access to X-Ray using IAM, see service documentation and policy examples.

Note that traces may include sensitive information in annotations and metadata.

AWS CloudTrail logs

AWS CloudTrail is an AWS service that helps you enable operational and risk auditing, governance, and compliance of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs. See service documentation on how to use IAM for access control.

Amazon EventBridge

In addition to CloudTrail logs, the API Gateway generates events that EventBridge receives in the default event bus. See service documentation on how to use IAM for the access control.

AWS Lambda authorizer logs

A Lambda authorizer is commonly used with API Gateway for client authorization. Consider controlling access to the Lambda function logs the same way as API Gateway execution logs. Lambda functions may use extensions that send logs to destinations other than CloudWatch Logs. Make sure that access to those destinations is managed according to their guidelines.

Access to other related resources

API Gateway often is used together with other services such as AWS Lambda for authorization, Amazon VPC and Network Load Balancer to access private resources, AWS Transit Gateway for accessing resources in other accounts, Amazon Cognito for user management. See individual service documentation for aguidance on how to implement access control and govern them.