0

AWS threw a below error saying the user doesn't have access to apigateway:TagResource permission, but when I checklist of available permissions in the IAM console, I'm not able to find any such permission.

xxxx is not authorized to perform: apigateway:TagResource on resource xxx

Currently, I've given the below permissions for that API.

{
    "Effect": "Allow",
    "Action": [
        "apigateway:DELETE",
        "apigateway:PUT",
        "apigateway:PATCH",
        "apigateway:POST",
        "apigateway:GET"
    ],
    "Resource": [
        "arn:aws:apigateway:*::/restapis*",
        "arn:aws:apigateway:*::/apikeys*",
        "arn:aws:apigateway:*::/usageplans*",
        "arn:aws:apigateway:*::/domainnames*",
        "arn:aws:apigateway:*::/tags*",
        "arn:aws:apigateway:*::/apis*"
    ],
    "Condition": {
        "StringLikeIfExists": {
            "apigateway:Request/apiName": "my-api*"
        }
    }
}

How to resolve this, any other permission is required?

4
  • Remove the condition block and add the explicit name of resource specified in the error, and then ensure, to add tagResouces permission in the Action block, retry and lets see
    – saviour123
    Nov 16, 2022 at 10:31
  • there is no such permission like apigateway:TagResource, I'm struggling with it. Nov 16, 2022 at 10:34
  • replace all this "apigateway:DELETE", "apigateway:PUT", "apigateway:PATCH", "apigateway:POST", "apigateway:GET" with "apigateway:*" try and lets see
    – saviour123
    Nov 16, 2022 at 10:40
  • Yeah, i tried that earlier, it's working, but how to specify the required permission instead of wildcard? Nov 17, 2022 at 12:38

1 Answer 1

1

I was dealing with a similar issue. Ultimately, the following worked for me:

{
  "Effect": "Allow",
  "Action": [
    "apigateway:POST",
    "apigateway:TagResource"
  ],
  "Resource": [
    "arn:aws:apigateway:*::/apis",
    "arn:aws:apigateway:*::/apis/*/stages"
  ],
  "Condition": {
    "StringEquals": {
      "aws:RequestTag/WbyProjectName": [
        "webiny-js"
      ]
    }
  }
}
2
  • 1
    Cool, but we'll get the below error in the I am policy visual editor right? "Invalid Action: The action apigateway:TagResource does not exist." did you just ignore that ? Dec 9, 2022 at 6:23
  • 1
    @DilLip_Chowdary yea, I ignored it and it worked, I think the editor checker hasn't been updated to include newer actions
    – Jun
    May 19, 2023 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.