[apigateway] Unable to add accurate resource policy

The resource policy is readonly in the RestApi. It’s only injectable at the constructor. This is a problem because I can’t get the ARN into the policy to control method level invocations. It seems like there’s a chicken/egg situation.

Also - changing the policy doesn’t seem to kick off a deployment of the API, meaning the changes have no effect. Adding the policy contents to the hash of the deployment logical id seems logical. (This might belong in it’s own issue).

What I’m really trying to accomplish is a customization of the RestApi (like LambdaRestApi did) but for a ‘flavoured’ . regional apigateway with some security features that I can share amongst the team.

Is making this mutable going to interfere with the template prepare() activities?

Opening this up will also let us apply policy statements after resources / methods have been added to the api.

      new apigateway.RestApi(this, 'testApi', {
        policy: new iam.PolicyDocument()
                .addStatement(new iam.PolicyStatement(iam.PolicyStatementEffect.Deny)
                    .addAction("execute-api:Invoke")
                    .addAnyPrincipal()
                    .addResource(`arn:aws:execute-api:${cdk.Aws.region}:*:<how-to-get-id>/prod/`)
                )
      })

[chillitom]

        const api = new apigateway.RestApi(this, 'api', {
            restApiName: 'API',
            policy: new iam.PolicyDocument({
                statements: [
                    new iam.PolicyStatement({ actions: ['execute-api:*'], resources: ['execute-api:/*'], effect: iam.Effect.DENY }),
                    new iam.PolicyStatement({
                        actions: ['execute-api:*'],
                        resources: ['execute-api:/*'],
                        effect: iam.Effect.ALLOW,
                        principals: [
                            authenticatedRole
                        ],
                    }),
                ]
            })
        })

Adding the above policy causes the deployment to hang on deploying the API and it has to be cancelled in the cloudformation console. Any ideas what’s up with this declaration?

Looking at the generated YAML, I don’t see the region, account or api name getting added to the arns.

[hoegertn]

@eladb anything on this topic? The not-refreshed deployment is not a gap. Instead, it should qualify as a bug.