Creating an aws_api_gateway_account resource returns AccessDeniedException

Question

In my terraform script I have the following resource -

resource "aws_api_gateway_account" "demo" {
  cloudwatch_role_arn = var.apigw_cloudwatch_role_arn
}

In the Apply stage, I see the following error -

2020/09/21 20:20:48 [ERROR] <root>: eval: *terraform.EvalApplyPost, err: Updating API Gateway Account failed: AccessDeniedException: 
    status code: 403, request id: abb0662e-ead2-4d95-b987-7d889088a5ef

Is there a specific permission that needs to be attached to the role in order to get rid of this error?

Answer 1

Ran into the same problem as @bdev03, took me 2 days to identify the missing permission is "iam:PassRole", be so good if terraform is able to point that out, hope this helps.

Answer 2

Since neither this thread (so far) nor the official documentation is doing a very good job at solving this problem... The minimal policies required for this action are:

{
  "Sid": "AllowPassingTheRoleToApiGateway",
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "iam:PassedToService": ["apigateway.amazonaws.com"]
    }
  }
}

{
  "Sid": "AllowAPIGatewayUpdate",
  "Effect": "Allow",
  "Action": [
      "apigateway:UpdateRestApiPolicy",
      "apigateway:PATCH",
      "apigateway:GET"
  ],
  "Resource": "*"
}

Answer 3

I haven't tested, but I believe the role needs what's shown below. See more context at the source: "To enable CloudWatch Logs" section at https://docs.aws.amazon.com/apigateway/latest/developerguide/stages.html

For common application scenarios, the IAM role could attach the managed policy of AmazonAPIGatewayPushToCloudWatchLogs, which contains the following access policy statement:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents", "logs:FilterLogEvents" ], "Resource": "*" } ] }

The IAM role must also contain the following trust relationship statement:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "", "Effect": "Allow", "Principal": { "Service": "apigateway.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }