Skip to content

fix: fix issues with API Gateway Access #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
erastusndico wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: fix issues with API Gateway Access #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .pre-commit-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ repos:
files: \.(tf|tfvars)$

- repo: https://github.com/bridgecrewio/checkov.git
rev: '3.2.484'
rev: '3.2.487'
hooks:
- id: checkov
name: checkov-aws
Expand Down
72 changes: 36 additions & 36 deletions aws/non-prod-infra/staging/apigateway_core.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,6 @@ resource "aws_lambda_permission" "core_apigw_lambda_get" {
function_name = "${module.core_lambda.lambda_function_name}:${var.core_lambda_alias}"
principal = "apigateway.amazonaws.com" #
source_arn = "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.core_api.id}/*/GET/"

lifecycle {
ignore_changes = [function_name, qualifier]
}
Expand All @@ -94,7 +93,6 @@ resource "aws_lambda_permission" "core_apigw_lambda_any" {
function_name = "${module.core_lambda.lambda_function_name}:${var.core_lambda_alias}"
principal = "apigateway.amazonaws.com"
source_arn = "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.core_api.id}/*/*/*"

lifecycle {
ignore_changes = [function_name, qualifier]
}
Expand All @@ -107,6 +105,8 @@ resource "aws_api_gateway_deployment" "core_deployment" {
aws_api_gateway_integration.core_put_method_root_integration,
aws_api_gateway_method.core_proxy_method,
aws_api_gateway_integration.core_proxy_integration,
aws_lambda_permission.core_apigw_lambda_get,
aws_lambda_permission.core_apigw_lambda_any,
]
rest_api_id = aws_api_gateway_rest_api.core_api.id
description = "Deployment of the KainosCore API"
Expand Down Expand Up @@ -136,40 +136,40 @@ resource "aws_api_gateway_stage" "core_stage" {
}
}

# Restricts API Gateway access to CloudFront in staging
resource "aws_api_gateway_rest_api_policy" "restrict_to_cloudfront" {
count = var.env == "staging" || var.env == "staging" ? 1 : 0
rest_api_id = aws_api_gateway_rest_api.core_api.id
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": "*",
"Action": "execute-api:Invoke",
"Resource": "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.core_api.id}/*",
"Condition": {
"StringEquals": {
"aws:SourceArn": "${aws_cloudfront_distribution.distribution.arn}"
}
}
},
{
"Effect": "Deny",
"Principal": "*",
"Action": "execute-api:Invoke",
"Resource": "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.core_api.id}/*",
"Condition": {
"StringNotEquals": {
"aws:SourceArn": "${aws_cloudfront_distribution.distribution.arn}"
}
}
}
]
}
EOF
}
# # Restricts API Gateway access to CloudFront in staging
# resource "aws_api_gateway_rest_api_policy" "restrict_to_cloudfront" {
# count = var.env == "staging" || var.env == "staging" ? 1 : 0
Copy link

Copilot AI Oct 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition var.env == \"staging\" || var.env == \"staging\" is redundant—it checks the same condition twice. This should likely be var.env == \"staging\" or compare against a different environment value.

Suggested change
# count = var.env == "staging" || var.env == "staging" ? 1 : 0
# count = var.env == "staging" ? 1 : 0

Copilot uses AI. Check for mistakes.
# rest_api_id = aws_api_gateway_rest_api.core_api.id
# policy = <<EOF
# {
# "Version": "2012-10-17",
# "Statement": [
# {
# "Effect": "Allow",
# "Principal": "*",
# "Action": "execute-api:Invoke",
# "Resource": "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.core_api.id}/*",
# "Condition": {
# "StringEquals": {
# "aws:SourceArn": "${aws_cloudfront_distribution.distribution.arn}"
# }
# }
# },
# {
# "Effect": "Deny",
# "Principal": "*",
# "Action": "execute-api:Invoke",
# "Resource": "arn:aws:execute-api:${var.region}:${data.aws_caller_identity.current.account_id}:${aws_api_gateway_rest_api.core_api.id}/*",
# "Condition": {
# "StringNotEquals": {
# "aws:SourceArn": "${aws_cloudfront_distribution.distribution.arn}"
# }
# }
# }
# ]
# }
# EOF
# }


# Configures method-level settings for the API stage
Expand Down