Update the API Gateway Resource Policy

2025-06-25 15:03:42 +02:00
parent 57b6d5eb75
commit ffff5c0869
1 changed files with 11 additions and 1 deletions
@@ -93,12 +93,22 @@ export class MccAPIInfraStack extends Stack {
                        effect: Effect.ALLOW,
                        principals: [new AnyPrincipal()],
                        actions: ['execute-api:Invoke'],
-                        resources: ['execute-api:/*'],
+                        resources: ['execute-api:/*/*/*'],
                        // Optionally, restrict by source VPC or VPC endpoint
                        conditions: {
                             StringEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
                         }
                    }),
+                    new PolicyStatement({
+                        effect: Effect.DENY,
+                        principals: [new AnyPrincipal()],
+                        actions: ['execute-api:Invoke'],
+                        resources: ['execute-api:/*/*/*'],
+                        // Optionally, restrict by source VPC or VPC endpoint
+                        conditions: {
+                             StringNotEquals: { 'aws:SourceVpce': executeApiVpcEndpoint.vpcEndpointId }
+                         }
+                    }),
                ],
            }),
        });