Get the ARN for the API gateway resource that the serverless framework creates within my serverless.yml file

Question

How can I get the ARN for the API gateway resource that the serverless framework creates within my serverless.yml file?

I want to get the ARN for the API Gateway resource so that I can use it within an IAM policy to perform IAM based authorization on the gateway.

Answer 1

The whole ARN for an API is of the form: arn:aws:execute-api:region:account-id:api-id/stage/METHOD_HTTP_VERB/Resource-path). Using { "Ref" : "ApiGatewayRestApi" } (link) within your serverless.yml gives you the apiId.

You can do something like the below (see the Resource section) to convert this to a whole Arn to reference an API:

PolicyName: InvokeAPI
PolicyDocument:
  Version: "2012-10-17"
  Statement:
    Effect: "Allow"
    Action: "execute-api:Invoke"
    Resource:
      - Fn::Join:
        - "/"
        - 
          - Fn::Join: [":", ["arn:aws:execute-api", {"Ref": "AWS::Region"}, {"Ref":"AWS::AccountId"}, {"Ref": "ApiGatewayRestApi"}]]
          - "*"