Merge pull request #34 from clouddrove/issue-408

added rest api policy and make api private

Author: yadavprakash

_example/basic/example.tf

@@ -12,6 +12,9 @@ module "api-gateway" {
   # Api Gateway Resource
   path_parts = ["mytestresource"]
 
+  ##endpoint_configuration
+  types = ["PRIVATE"]
+
   # Api Gateway Method
   method_enabled = true
   http_methods   = ["GET"]
@@ -55,4 +58,28 @@ EOF
   # Api Gateway Stage
   stage_enabled = true
   stage_names   = ["qa"]
+  ## Api Policy
+
+  api_policy = data.aws_iam_policy_document.test.json
+
+}
+
+data "aws_iam_policy_document" "test" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    actions   = ["execute-api:Invoke"]
+    resources = [module.api-gateway.execution_arn]
+
+    condition {
+      test     = "IpAddress"
+      variable = "aws:SourceIp"
+      values   = ["123.123.123.123/32"]
+    }
+  }
 }

_example/complete/example.tf

@@ -83,4 +83,29 @@ EOF
   # Api Gateway Api Key
   key_count = 2
   key_names = ["test", "test1"]
+
+  ## Api Policy
+
+  api_policy = data.aws_iam_policy_document.test.json
+
 }
+
+data "aws_iam_policy_document" "test" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
+    actions   = ["execute-api:Invoke"]
+    resources = [module.api-gateway.execution_arn]
+
+    condition {
+      test     = "IpAddress"
+      variable = "aws:SourceIp"
+      values   = ["123.123.123.123/32"]
+    }
+  }
+}

main.tf

@@ -33,10 +33,15 @@ resource "aws_api_gateway_rest_api" "default" {
     types            = var.types
     vpc_endpoint_ids = length(var.vpc_endpoint_ids) > 0 && var.vpc_endpoint_ids[0] != "" ? var.vpc_endpoint_ids : null
   }
-  policy = var.api_policy
   tags   = var.tags
 }
 
+
+resource "aws_api_gateway_rest_api_policy" "test" {
+  rest_api_id = join("", aws_api_gateway_rest_api.default.*.id)
+  policy      = var.api_policy
+}
+
 # Module      : Api Gateway Resource
 # Description : Terraform module to create Api Gateway resource on AWS.
 resource "aws_api_gateway_resource" "default" {