(upbeat music)
- Hello, I'm Joely, a Cloud Support Engineer here
at the AWS office in Sydney.
Sometimes customers asked me,
"How do I implement IAM authentication for APIs created
"with Amazon API Gateway?"
So let me show you how.
In this video we'll use the PetStore example API.
So first, let's enable IAM authentication for this API.
After logging into the AWS Management Console,
navigate to the API Gateway console.
Select your API, and make sure you're on the Resources.
Select the method under the resource you want to use
to enable the authentication.
For our example, we'll enable IAM authentication
for the GET method for the pets resource.
Select the method request from the pane on the right.
If you created your API using the example API instructions
the Auth setting for the method request
is set to none by default.
Select the pencil icon on the right of Authorization NONE.
It will display a drop-down box that you can use
to change the authorization settings.
Let's change it from NONE to AWS IAM.
And then select the checkbox on the right
to confirm your choice.
We'll now deploy this API to a stage
by clicking on the Actions button under API Actions,
Deploy API.
Because this is the first time we're deploying this API,
we'll create a new stage called demo and click on deploy.
We can now invoke the stage with the invoke URL
displayed in the state editor.
As we enabled IAM authentication on only the GET method
for the pets resource,
by default we'll still be able to invoke the other methods
of API such as the GET method for the route path.
Let's test this using Postman.
I will now paste in the URL I copied,
make sure the http method here is GET.
Now let's test this by clicking on the send button.
As you can see the status returned a 200 okay,
and we can see the body produced here.
To verify if the IAM authentication was enabled,
let's try to invoke the GET method for the pets resource.
Now I'll be adding the pets path resource to the URL.
Now to test again, let's hit send.
As expected, we get a missing authentication token error.
Now let's set up individual IAM user to invoke this API.
To do this, we'll be moving back to the console.
Open the IAM console
and then select Users.
Choose Add User and then name it demo user.
Select programmatic access so the requests
can be authenticated without IAM credentials.
Click Next Permissions
and select attach existing policies directly.
In terms of the permissions policy,
we'll attach the Amazon API gateway
invoke full access policy to grant the user permissions
to invoke the API's.
We'll use the search functionality
to search for the permissions policy.
Click Next.
Next, and click on create user to create the user.
After the user has been created,
we can now import the access and secret keys
into Postman for testing.
So let's move over to Postman.
To test this using Postman use the access key ID
and secret access key.
Under the Authorization tab,
click on the drop-down box under type.
Select AWS Signature and enter the IAM users
access and secret keys into the corresponding
access and secret key fields.
Specify an appropriate AWS region
that matches the region specified and the invocation URL,
and enter execute dash API and the service name.
After everything has been filled out,
we can now press the send button.
Postman will make a CSV for signed request to the API.
As shown, we're now able to successfully invoke the API
with the newly created IAM user credentials.
To recap, today, we learn how to implement
IAM authentication for API's and Amazon API Gateway
by enabling authentication for a particular resource method
and also adding the necessary permissions for the IAM user.
Thanks for watching and happy cloud computing
from all of us here at AWS.
(upbeat music)