[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"content-guides-api-gateway-governance-management_access":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":8,"contributorPaths":9,"menuType":11,"contentName":12,"slug":13,"readingTime":14,"menu":15,"nextDocItem":49,"previousDocItem":39},"\u003Cp>Note: This section focuses on controlling who can manage Amazon API Gateway APIs and related resources (control plane). For API access control (data plane) see the \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-to-api.html\">documentation\u003C\u002Fa>.\u003C\u002Fp>\n\u003Ch3>API management access\u003C\u002Fh3>\n\u003Cp>Access to the individual API management is controlled, as for any other AWS resource, by AWS Identity and Access Management (IAM). You can explicitly allow actions on the API by granting permissions on \u003Ccode>RestApi\u003C\u002Fcode> resource. The following policy explicitly allows all actions on the REST API with ID \u003Ccode>abcd123456\u003C\u002Fcode> in \u003Ccode>us-east-1\u003C\u002Fcode> Region, along with API sub-resources such as stages, deployments, authorizers, request validators, etc.: \u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n"Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "AllowAllActions",\n      "Effect": "Allow",\n      "Action": [\n        "apigateway:*"\n      ],\n      "Resource": [\n        "arn:aws:apigateway:us-east-1::\u002Frestapis\u002Fabcd123456\u002F*"\n      ]\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>This policy does not grant access to the custom domains, client certificates, VPC links, API keys, or usage plans. It also does not explicitly allow management of other APIs. Because an IAM principal is denied access by default, they must be explicitly allowed to perform an action. See documentation for more details on \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Freference_policies_evaluation-logic.html#AccessPolicyLanguage_Interplay\">implicit and explicit denies\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html#amazonapigatewaymanagement-resources-for-iam-policies\">list of resource types\u003C\u002Fa> in API Gateway management.\u003C\u002Fp>\n\u003Ch3>Access to the observability information\u003C\u002Fh3>\n\u003Cp>Access to the observability tools and data should be limited in a similar way you control access to the API management. Access control details depend on data type and storage\u002Fdestination. Amazon CloudWatch has various features to help gain insights using logs, metrics, and traces. See overall \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Fmonitoring\u002Fauth-and-access-control-cw.html\">Identity and access management for Amazon CloudWatch\u003C\u002Fa> and documentation of individual features you may use (dashboards, integrations, contributor insights, etc.), in addition to the information linked below.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Execution logs\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>API Gateway execution logs are delivered to CloudWatch Logs. See CloudWatch Logs \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fiam-identity-based-access-control-cwl.html\">service documentation\u003C\u002Fa> on how to use IAM for access control. CloudWatch Logs allow \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002FCWL_OpenSearch_Stream.html\">streaming data to OpenSearch service\u003C\u002Fa> or \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002FS3Export.html\">exporting to S3\u003C\u002Fa>. In these cases, see relevant service documentation on how to control access to the data.\u003C\u002Fp>\n\u003Cp>\u003Cem>Note that execution logs may include full request and response data. Safeguard sensitive data ingested by CloudWatch Logs by using \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fmask-sensitive-log-data.html\">log group data protection policies\u003C\u002Fa>. These policies let you audit and mask sensitive data that appears in log events ingested by the log groups in your account.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Access logs\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>API Gateway access logs are delivered to CloudWatch Logs or Amazon Data Firehose. See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fiam-identity-based-access-control-cwl.html\">service documentation\u003C\u002Fa> on how to use IAM for access control to control access to CloudWatch Logs. When when you use Firehose to deliver logs, you must implement access control at both Firehose (see \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Ffirehose\u002Flatest\u002Fdev\u002Fcontrolling-access.html\">documentation\u003C\u002Fa>) and the destination. As Firehose supports \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Ffirehose\u002Flatest\u002Fdev\u002Fcreate-destination.html\">multiple destination types\u003C\u002Fa>, including external systems, consult relevant service documentation for more information on access management.\u003C\u002Fp>\n\u003Cp>\u003Cem>Note that access logs may include sensitive information. Safeguard what's ingested by CloudWatch Logs by using \u003Cem>\u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fmask-sensitive-log-data.html\">\u003Cem>log group data protection policies\u003C\u002Fem>\u003C\u002Fa>\u003C\u002Fem>. These policies let you audit and mask sensitive data that appears in log events ingested by the log groups in your account.\u003C\u002Fem>\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Metrics\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Fmonitoring\u002Fauth-and-access-control-cw.html\">service documentation\u003C\u002Fa> for more information on how to control access to CloudWatch Logs. Note, that metrics may be \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Fmonitoring\u002FCloudWatch-Metric-Streams.html\">streamed\u003C\u002Fa> to other systems so make sure to implement access controls in those systems following their guidelines.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Traces\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>API Gateway uses AWS X-Ray to collect traces. For information on how to control access to X-Ray using IAM, see \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fxray\u002Flatest\u002Fdevguide\u002Fsecurity_iam_service-with-iam.html\">service documentation\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fxray\u002Flatest\u002Fdevguide\u002Fsecurity_iam_id-based-policy-examples.html\">policy examples\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>\u003Cem>Note that traces may include sensitive information in annotations and metadata.\u003C\u002Fem> \u003C\u002Fp>\n\u003Cp>\u003Cstrong>AWS CloudTrail logs\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>AWS CloudTrail is an AWS service that helps you enable operational and risk auditing, governance, and compliance of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs. See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fawscloudtrail\u002Flatest\u002Fuserguide\u002Fsecurity-iam.html\">service documentation\u003C\u002Fa> on how to use IAM for access control.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Amazon EventBridge\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>In addition to CloudTrail logs, the API Gateway generates events that EventBridge receives in the default event bus. See \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Feventbridge\u002Flatest\u002Fuserguide\u002Feb-iam.html\">service documentation\u003C\u002Fa> on how to use IAM for the access control.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>AWS Lambda authorizer logs\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>A Lambda authorizer is commonly used with API Gateway for client authorization. Consider controlling access to the \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Fmonitoring-cloudwatchlogs.html\">Lambda function logs\u003C\u002Fa> the same way as API Gateway execution logs. Lambda functions may use \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Flambda-extensions.html\">extensions\u003C\u002Fa> that send logs to destinations other than CloudWatch Logs. Make sure that access to those destinations is managed according to their guidelines.\u003C\u002Fp>\n\u003Ch3>Access to other related resources\u003C\u002Fh3>\n\u003Cp>API Gateway often is used together with other services such as \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Flambda\u002F\">AWS Lambda\u003C\u002Fa> for authorization, \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fvpc\u002F\">Amazon VPC\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Felasticloadbalancing\u002Fnetwork-load-balancer\u002F\">Network Load Balancer\u003C\u002Fa> to access private resources, \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Ftransit-gateway\u002F\">AWS Transit Gateway\u003C\u002Fa> for accessing resources in other accounts, \u003Ca href=\"https:\u002F\u002Faws.amazon.com\u002Fcognito\u002F\">Amazon Cognito\u003C\u002Fa> for user management. See individual service documentation for aguidance on how to implement access control and govern them.\u003C\u002Fp>\n",{"title":6,"order":7},"API management access control",4,"Note: This section focuses on controlling who can manage Amazon API Gateway APIs and related resources (control plane). For API access control (data plane) see the [documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-to-api.html).\n\n###  API management access\n\nAccess to the individual API management is controlled, as for any other AWS resource, by AWS Identity and Access Management (IAM). You can explicitly allow actions on the API by granting permissions on `RestApi` resource. The following policy explicitly allows all actions on the REST API with ID `abcd123456` in `us-east-1` Region, along with API sub-resources such as stages, deployments, authorizers, request validators, etc.: \n\n```json\n{\n\"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"AllowAllActions\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"apigateway:*\"\n      ],\n      \"Resource\": [\n        \"arn:aws:apigateway:us-east-1::\u002Frestapis\u002Fabcd123456\u002F*\"\n      ]\n    }\n  ]\n}\n```\n\nThis policy does not grant access to the custom domains, client certificates, VPC links, API keys, or usage plans. It also does not explicitly allow management of other APIs. Because an IAM principal is denied access by default, they must be explicitly allowed to perform an action. See documentation for more details on [implicit and explicit denies](https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Freference_policies_evaluation-logic.html#AccessPolicyLanguage_Interplay) and [list of resource types](https:\u002F\u002Fdocs.aws.amazon.com\u002Fservice-authorization\u002Flatest\u002Freference\u002Flist_amazonapigatewaymanagement.html#amazonapigatewaymanagement-resources-for-iam-policies) in API Gateway management.\n\n### Access to the observability information\n\nAccess to the observability tools and data should be limited in a similar way you control access to the API management. Access control details depend on data type and storage\u002Fdestination. Amazon CloudWatch has various features to help gain insights using logs, metrics, and traces. See overall [Identity and access management for Amazon CloudWatch](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Fmonitoring\u002Fauth-and-access-control-cw.html) and documentation of individual features you may use (dashboards, integrations, contributor insights, etc.), in addition to the information linked below.\n\n**Execution logs**\n\nAPI Gateway execution logs are delivered to CloudWatch Logs. See CloudWatch Logs [service documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fiam-identity-based-access-control-cwl.html) on how to use IAM for access control. CloudWatch Logs allow [streaming data to OpenSearch service](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002FCWL_OpenSearch_Stream.html) or [exporting to S3](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002FS3Export.html). In these cases, see relevant service documentation on how to control access to the data.\n\n*Note that execution logs may include full request and response data. Safeguard sensitive data ingested by CloudWatch Logs by using [log group data protection policies](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fmask-sensitive-log-data.html). These policies let you audit and mask sensitive data that appears in log events ingested by the log groups in your account.*\n\n**Access logs**\n\nAPI Gateway access logs are delivered to CloudWatch Logs or Amazon Data Firehose. See [service documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fiam-identity-based-access-control-cwl.html) on how to use IAM for access control to control access to CloudWatch Logs. When when you use Firehose to deliver logs, you must implement access control at both Firehose (see [documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Ffirehose\u002Flatest\u002Fdev\u002Fcontrolling-access.html)) and the destination. As Firehose supports [multiple destination types](https:\u002F\u002Fdocs.aws.amazon.com\u002Ffirehose\u002Flatest\u002Fdev\u002Fcreate-destination.html), including external systems, consult relevant service documentation for more information on access management.\n\n*Note that access logs may include sensitive information. Safeguard what's ingested by CloudWatch Logs by using *[*log group data protection policies*](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fmask-sensitive-log-data.html)*. These policies let you audit and mask sensitive data that appears in log events ingested by the log groups in your account.*\n\n**Metrics**\n\nSee [service documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Fmonitoring\u002Fauth-and-access-control-cw.html) for more information on how to control access to CloudWatch Logs. Note, that metrics may be [streamed](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Fmonitoring\u002FCloudWatch-Metric-Streams.html) to other systems so make sure to implement access controls in those systems following their guidelines.\n\n**Traces**\n\nAPI Gateway uses AWS X-Ray to collect traces. For information on how to control access to X-Ray using IAM, see [service documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fxray\u002Flatest\u002Fdevguide\u002Fsecurity_iam_service-with-iam.html) and [policy examples](https:\u002F\u002Fdocs.aws.amazon.com\u002Fxray\u002Flatest\u002Fdevguide\u002Fsecurity_iam_id-based-policy-examples.html).\n\n*Note that traces may include sensitive information in annotations and metadata.* \n\n**AWS CloudTrail logs**\n\nAWS CloudTrail is an AWS service that helps you enable operational and risk auditing, governance, and compliance of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Events include actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs. See [service documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Fawscloudtrail\u002Flatest\u002Fuserguide\u002Fsecurity-iam.html) on how to use IAM for access control.\n\n**Amazon EventBridge**\n\nIn addition to CloudTrail logs, the API Gateway generates events that EventBridge receives in the default event bus. See [service documentation](https:\u002F\u002Fdocs.aws.amazon.com\u002Feventbridge\u002Flatest\u002Fuserguide\u002Feb-iam.html) on how to use IAM for the access control.\n\n**AWS Lambda authorizer logs**\n\nA Lambda authorizer is commonly used with API Gateway for client authorization. Consider controlling access to the [Lambda function logs](https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Fmonitoring-cloudwatchlogs.html) the same way as API Gateway execution logs. Lambda functions may use [extensions](https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Flambda-extensions.html) that send logs to destinations other than CloudWatch Logs. Make sure that access to those destinations is managed according to their guidelines.\n\n### Access to other related resources\n\nAPI Gateway often is used together with other services such as [AWS Lambda](https:\u002F\u002Faws.amazon.com\u002Flambda\u002F) for authorization, [Amazon VPC](https:\u002F\u002Faws.amazon.com\u002Fvpc\u002F) and [Network Load Balancer](https:\u002F\u002Faws.amazon.com\u002Felasticloadbalancing\u002Fnetwork-load-balancer\u002F) to access private resources, [AWS Transit Gateway](https:\u002F\u002Faws.amazon.com\u002Ftransit-gateway\u002F) for accessing resources in other accounts, [Amazon Cognito](https:\u002F\u002Faws.amazon.com\u002Fcognito\u002F) for user management. See individual service documentation for aguidance on how to implement access control and govern them.\n",[10],"content\u002Fcontributors\u002Fgiedrius-praspaliauskas.json","LIST","Amazon API Gateway governance in depth","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement_access","4 min",[16,55,84],{"title":17,"content":18},"Amazon API Gateway governance",[19,32,39,46,49],{"title":20,"order":21,"authors":22,"callout":24,"time":28,"path":29,"id":30,"link":31},"Introduction",1,[23],"Giedrius Praspaliauskas",{"title":25,"description":26,"link":27},"Building an API platform on AWS","This guide summarizes the API lifecycle and provides an AWS point of view on building an API platform using Amazon API Gateway. It provides prescriptive guidance on 3rd party and AWS services to cover the end-to-end needs of the API lifecycle.","https:\u002F\u002Fserverlessland.com\u002Fcontent\u002Fservice\u002Fapi-gateway\u002Fpaved-path\u002Fbuilding-an-api-platform-on-aws\u002Fintroduction","1 min","introduction","introduction.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fintroduction",{"title":33,"order":34,"time":35,"path":36,"id":37,"link":38},"Security controls",2,"2 min","controls","controls.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fcontrols",{"title":40,"order":41,"time":42,"path":43,"id":44,"link":45},"Tools",3,"7 min","tools","tools.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Ftools",{"title":6,"order":7,"time":14,"path":47,"id":48,"link":13},"management_access","management_access.md",{"title":50,"order":51,"time":28,"path":52,"id":53,"link":54},"API management audit",5,"audit_track","audit_track.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faudit_track",{"title":56,"content":57},"Use cases and examples",[58,64,71,78],{"title":59,"order":60,"time":28,"path":61,"id":62,"link":63},"Use-cases overview",6,"use_cases","use_cases.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fuse_cases",{"title":65,"order":66,"time":67,"path":68,"id":69,"link":70},"Enforcing observability for governance",8,"3 min","observability","observability.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fobservability",{"title":72,"order":73,"time":74,"path":75,"id":76,"link":77},"Enforcing security for governance",9,"5 min","access_control","access_control.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Faccess_control",{"title":79,"order":80,"time":14,"path":81,"id":82,"link":83},"Enforcing management control",10,"management","management.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fmanagement",{"title":85,"content":86},"Summary",[87,93],{"title":88,"order":89,"time":28,"path":90,"id":91,"link":92},"Index of examples",11,"index","index.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Findex",{"title":94,"order":95,"time":28,"path":96,"id":97,"link":98},"Additional resources",12,"additional_resources","additional_resources.md","\u002Fcontent\u002Fguides\u002Fapi-gateway-governance\u002Fadditional_resources",1792665264186]