# How to create AWS API Gateway Resource Policy section by using serverless framework

**URL:** <https://forum.serverless.com/t/how-to-create-aws-api-gateway-resource-policy-section-by-using-serverless-framework/4619>\
**Category:** Serverless Framework\
**Created:** [May 31, 2018, 5:23am UTC](https://forum.serverless.com/t/how-to-create-aws-api-gateway-resource-policy-section-by-using-serverless-framework/4619 "2018-05-31T05:23:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![niladri\_maiti](https://avatars.discourse-cdn.com/v4/letter/n/ecccb3/32.png) [@niladri\_maiti](https://forum.serverless.com/u/niladri_maiti)\
**Post date:** [May 31, 2018, 5:23am UTC](https://forum.serverless.com/t/how-to-create-aws-api-gateway-resource-policy-section-by-using-serverless-framework/4619/1 "2018-05-31T05:23:02Z")

</div>

Hi,  
Since AWS API gateway is publicly accessible we want to apply policies to white-list desired IPs to access API gateway. It can be done from AWS console by add policies in API Gateway -\> Resources Policy section. Since we are using serverless framework to setup our project , want to add Resource Policy by using serverless framework.

Can you please inform how can I do it using serverless? If it is not available in serverless do you have any plan to add this functionality.

Thanks  
Niladri

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [May 31, 2018, 10:41am UTC](https://forum.serverless.com/t/how-to-create-aws-api-gateway-resource-policy-section-by-using-serverless-framework/4619/2 "2018-05-31T10:41:31Z")

</div>

It looks like this isn’t supported by CloudFormation yet. Until then you’ll need to use one of the other mechanisms.

> <https://github.com/serverless/serverless/issues/4926>
>
> \<!--
> 1. If you have a question and not a bug/feature request please ask it at h…ttp://forum.serverless.com
> 2. Please check if an issue already exists so there are no duplicates
> 3. Check out and follow our Guidelines: https://github.com/serverless/serverless/blob/master/CONTRIBUTING.md
> 4. Fill out the whole template so we have a good overview on the issue
> 5. Do not remove any section of the template. If something is not applicable leave it empty but leave it in the Issue
> 6. Please follow the template, otherwise we'll have to ask you to update it
> \--\>
> 
> \# This is a Feature Proposal
> 
> \## Description
> Recently API Gateway (April 2nd, 2018) started providing resource policy to handle each API. Which includes blacklisting IP or allowing denying IP.
> 
> This is currently only supported by the API Gateway API, AWS console, AWS SDK and not yet by CloudFormation, which I'm guessing is why it is not yet supported by Serverless. 
> 
> \[Announcement\](https://aws.amazon.com/about-aws/whats-new/2018/04/amazon-api-gateway-supports-resource-policies/)
> 
> \[Blog for console-based setup\](https://lobster1234.github.io/2018/04/14/amazon-api-gateway-ip-whitelisting/)
> 
> Probably best to wait for CloudFormation to catch up on this so I'm just registering for a future task.
> 
> 
> For feature proposals:
> \* IP Blacklisting or allowing a certain type of method. Basically IAM type policy but without creating IAM role/policy.
> \* Json input or parameter based information can be set up.  
> 
> Note
> \*\* \[Forum Question in relation\](https://forum.serverless.com/t/api-gateway-resource-policy/4215
> )

---

<div class="post-metadata">

**Author:** ![mpolitaev](https://avatars.discourse-cdn.com/v4/letter/m/d26b3c/32.png) [@mpolitaev](https://forum.serverless.com/u/mpolitaev)\
**Post date:** [October 25, 2018, 7:28pm UTC](https://forum.serverless.com/t/how-to-create-aws-api-gateway-resource-policy-section-by-using-serverless-framework/4619/3 "2018-10-25T19:28:25Z")

</div>

Is this still not implemented? I see in documentation for serverless property “resourcePolicy”  
I use serverless 1.24 version but when i specify this “resourcePolicy” property it do not appear in cloudformation template. Why it can be so? Thank you.