TDR-3364 - Create a rest policy for the api gateway (#27)

nationalarchives · Sep 15, 2023 · 8568c3a · 8568c3a
1 parent 31abc25
commit 8568c3a
Show file tree

Hide file tree

Showing 4 changed files with 24 additions and 1 deletion.
diff --git a/terraform/da-terraform-configurations b/terraform/da-terraform-configurations
diff --git a/terraform/root_locals.tf b/terraform/root_locals.tf
@@ -15,4 +15,6 @@ locals {
   reference_generator_function_name    = "${var.project}-reference-generator-${local.hosting_environment}"
   reference_generator_api_gateway_name = "${upper(var.project)}ReferenceGenerator${local.hosting_environment}"
   reference_counter_table_name         = "${var.project}-reference-counter"
+  api_task_role_arn                    = module.terraform_config_hosting_project.terraform_config[local.hosting_environment]["api_task_role_arn"]
+  api_execution_role_arn               = module.terraform_config_hosting_project.terraform_config[local.hosting_environment]["api_execution_role_arn"]
 }
diff --git a/terraform/root_main.tf b/terraform/root_main.tf
@@ -63,4 +63,9 @@ module "reference_generator_api_gateway" {
   api_name    = local.reference_generator_api_gateway_name
   environment = local.hosting_environment
   common_tags = local.hosting_common_tags
+  api_rest_policy = templatefile("${path.module}/templates/api_gateway/reference_generator_rest_policy.json.tpl", {
+    api_gateway_arn        = module.reference_generator_api_gateway.api_execution_arn
+    api_task_role_arn      = local.api_task_role_arn
+    api_execution_role_arn = local.api_execution_role_arn
+  })
 }
diff --git a/terraform/templates/api_gateway/reference_generator_rest_policy.json.tpl b/terraform/templates/api_gateway/reference_generator_rest_policy.json.tpl
@@ -0,0 +1,16 @@
+{
+  "Version":"2012-10-17",
+  "Statement":[
+    {
+      "Effect":"Allow",
+      "Principal":{
+        "AWS":[
+          "${api_task_role_arn}",
+          "${api_execution_role_arn}"
+        ]
+      },
+      "Action":"execute-api:Invoke",
+      "Resource":"${api_gateway_arn}"
+    }
+  ]
+}