# How can you create an IAM policy with execute-api:Invoke action for the API endpoint created by Serverless

**URL:** https://forum.serverless.com/t/how-can-you-create-an-iam-policy-with-execute-api-invoke-action-for-the-api-endpoint-created-by-serverless/3203
**Category:** Serverless Framework
**Created:** [November 27, 2017, 7:16pm UTC](https://forum.serverless.com/t/how-can-you-create-an-iam-policy-with-execute-api-invoke-action-for-the-api-endpoint-created-by-serverless/3203 "2017-11-27T19:16:35Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Nosajool](https://avatars.discourse-cdn.com/v4/letter/n/c4cdca/32.png) [@Nosajool](https://forum.serverless.com/u/Nosajool)
#### Post date: [November 27, 2017, 7:16pm UTC](https://forum.serverless.com/t/how-can-you-create-an-iam-policy-with-execute-api-invoke-action-for-the-api-endpoint-created-by-serverless/3203/1 "2017-11-27T19:16:35Z")

</div>

Suppose I want to create a policy that gives the `execute-api:Invoke` action permission to a role. What do I put as the `{?}` in order to reference the API created by `serverless deploy` :

```auto
          - PolicyName: invoke-api-gateway
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - execute-api:Invoke
                  Resource:
                    - Ref: {?}

```

---

<div class="post-metadata">

### Author: ![Nosajool](https://avatars.discourse-cdn.com/v4/letter/n/c4cdca/32.png) [@Nosajool](https://forum.serverless.com/u/Nosajool)
#### Post date: [November 27, 2017, 9:45pm UTC](https://forum.serverless.com/t/how-can-you-create-an-iam-policy-with-execute-api-invoke-action-for-the-api-endpoint-created-by-serverless/3203/2 "2017-11-27T21:45:39Z")

</div>

This seems to work:

```auto
Resource: { "Fn::Join" : ["", ["arn:aws:execute-api:",{"Ref":"AWS::Region"},":",{"Ref":"AWS::AccountId"},":",{"Ref":"ApiGatewayRestApi"},"/*"]]}

```