[{"data":1,"prerenderedAt":31},["ShallowReactive",2],{"snippet-apigw-allow-invoke-only-for-role-and-vpce":3},{"id":4,"title":5,"contributors":6,"description":8,"extension":9,"gitHub":10,"introBox":13,"languages":17,"meta":19,"resources":20,"services":21,"snippets":23,"stem":27,"tags":28,"type":29,"__hash__":30},"snippets\u002Fsnippets\u002Fapigw-allow-invoke-only-for-role-and-vpce.json","Private API Gateway resource policy to allow invoke for both an IAM role & from a VPCE",[7],"content\u002Fcontributors\u002Fabhishek-agawane.json","Using this resource policy a private API Gateway can be restricted to be invoked by both an IAM role and a VPC endpoint. ","json",{"template":11},{"repoURL":12},"https:\u002F\u002Fgithub.com\u002Faws-samples\u002Fserverless-snippets\u002Ftree\u002Fmain\u002Fapigw-allow-invoke-only-for-role-and-vpce",{"headline":14,"text":15},"How it works",[16],"The resource policy allows to invoke a Private API only using a particular IAM role and from VPC endpoint",[18],"JSON",{},null,[22],"apigw",[24],{"title":25,"language":18,"code":26},"Limit API invoke using both IAM Role and VPCE","{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::<account-id>:role\u002F<iam-role-arn>\"\n            },\n            \"Action\": \"execute-api:Invoke\",\n            \"Resource\": \"arn:aws:execute-api:us-east-1:<account-id>:<api-id>\u002F*\"\n        },\n        {\n            \"Effect\": \"Deny\",\n            \"Principal\": {\n                \"AWS\": \"arn:aws:iam::<account-id>:role\u002F<iam-role-arn>\"\n            },\n            \"Action\": \"execute-api:Invoke\",\n            \"Resource\": \"arn:aws:execute-api:us-east-1:<account-id>:<api-id>\u002F*\",\n            \"Condition\": {\n                \"StringNotEquals\": {\n                    \"aws:SourceVpce\": \"<vpce-id>\"\n                }\n            }\n        },\n        {\n            \"Effect\": \"Deny\",\n            \"Principal\": {\n                \"AWS\": \"*\"\n            },\n            \"Action\": \"execute-api:Invoke\",\n            \"Resource\": \"arn:aws:execute-api:us-east-1:<account-id>:<api-id>\u002F*\",\n            \"Condition\": {\n                \"StringNotEquals\": {\n                    \"aws:PrincipalArn\": \"arn:aws:iam::<account-id>:role\u002F<iam-role-arn>\"\n                }\n            }\n        }\n    ]\n}\n","snippets\u002Fapigw-allow-invoke-only-for-role-and-vpce",[],"Integration","d42wpWGvZFVq7tb9F5qotX66YkwOEAPT8jZxtPY8nDc",1792578863897]