# API Gateway Resource Policy

**URL:** https://forum.serverless.com/t/api-gateway-resource-policy/4215
**Category:** Serverless Framework
**Created:** [April 10, 2018, 1:58pm UTC](https://forum.serverless.com/t/api-gateway-resource-policy/4215 "2018-04-10T13:58:26Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![lepirlouit](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/lepirlouit/32/1830_2.png) [@lepirlouit](https://forum.serverless.com/u/lepirlouit)
#### Post date: [April 10, 2018, 1:58pm UTC](https://forum.serverless.com/t/api-gateway-resource-policy/4215/1 "2018-04-10T13:58:26Z")

</div>

Amazon just introduced API Gateway Resource Policy  
This is fine for static authorizers eg ip whitelistings.  
[https://aws.amazon.com/about-aws/whats-new/2018/04/amazon-api-gateway-supports-resource-policies/](https://aws.amazon.com/about-aws/whats-new/2018/04/amazon-api-gateway-supports-resource-policies/)

eg : [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies-examples.html)

How to apply this with serverless.yml

---

<div class="post-metadata">

### Author: ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)
#### Post date: [April 12, 2018, 10:54am UTC](https://forum.serverless.com/t/api-gateway-resource-policy/4215/2 "2018-04-12T10:54:59Z")

</div>

Thanks to post this update.

My understand is, serverless framework only takes care of lambda iam role and its policy in block of `provider -> iamRoleStatements`

If you need manage IAM role to API Gateway, you can directly copy/paste the sample codes from your URLs to Resources block, as normal cloudformation json/yaml codes.

---

<div class="post-metadata">

### Author: ![thepauleh](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/thepauleh/32/2032_2.png) [@thepauleh](https://forum.serverless.com/u/thepauleh)
#### Post date: [June 1, 2018, 10:02am UTC](https://forum.serverless.com/t/api-gateway-resource-policy/4215/3 "2018-06-01T10:02:18Z")

</div>

Just to save people a few clicks.

At present cloudformation does not support apigateway resource policies.

The following issue has been created on serverless - you could subscribe to this to be notified when cloudformation supports it so someone is able to implement it in serverless.

> <https://github.com/serverless/serverless/issues/4926>
>
> \<!--
> 1. If you have a question and not a bug/feature request please ask it at h…ttp://forum.serverless.com
> 2. Please check if an issue already exists so there are no duplicates
> 3. Check out and follow our Guidelines: https://github.com/serverless/serverless/blob/master/CONTRIBUTING.md
> 4. Fill out the whole template so we have a good overview on the issue
> 5. Do not remove any section of the template. If something is not applicable leave it empty but leave it in the Issue
> 6. Please follow the template, otherwise we'll have to ask you to update it
> \--\>
> 
> \# This is a Feature Proposal
> 
> \## Description
> Recently API Gateway (April 2nd, 2018) started providing resource policy to handle each API. Which includes blacklisting IP or allowing denying IP.
> 
> This is currently only supported by the API Gateway API, AWS console, AWS SDK and not yet by CloudFormation, which I'm guessing is why it is not yet supported by Serverless. 
> 
> \[Announcement\](https://aws.amazon.com/about-aws/whats-new/2018/04/amazon-api-gateway-supports-resource-policies/)
> 
> \[Blog for console-based setup\](https://lobster1234.github.io/2018/04/14/amazon-api-gateway-ip-whitelisting/)
> 
> Probably best to wait for CloudFormation to catch up on this so I'm just registering for a future task.
> 
> 
> For feature proposals:
> \* IP Blacklisting or allowing a certain type of method. Basically IAM type policy but without creating IAM role/policy.
> \* Json input or parameter based information can be set up.  
> 
> Note
> \*\* \[Forum Question in relation\](https://forum.serverless.com/t/api-gateway-resource-policy/4215
> )

---

<div class="post-metadata">

### Author: ![dbeckwith01](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/dbeckwith01/32/1948_2.png) [@dbeckwith01](https://forum.serverless.com/u/dbeckwith01)
#### Post date: [June 14, 2018, 9:12pm UTC](https://forum.serverless.com/t/api-gateway-resource-policy/4215/4 "2018-06-14T21:12:32Z")

</div>

While the CF support is being developed is their a recommend way of implementing a resource policy after Serverless deploy has been executed?