AWS API Gateway IAM Policy Role in Docs Fails in Simulation

Question

The AWS IAM Policy Docs for AWS (shown here) indicate that the following policy gives full access for a role to hit the API Gateway

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "apigateway:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

When simulating that policy with API Gateway as the target, the policy denies access. This seems like a direct contradiction to the provided documentation.

Answer 1

Amazon's permissions model divides API Gateway permissions into two services:

• Amazon API Gateway - Permissions for clients, currently the only action is execute-api:invoke.
• Manage - API Gateway - Admin permissions for configuring the API Gateway, which has CRUD actions fitting the apigateway:* spec.

The policy you have applies to the Manage API Gateway service, the simulation should work if you select that.

This same separation is visible in the regular IAM policy wizard, where "Manage - API Gateway" sorts to the bottom of the service list where you can't see it.