The page has been translated by Gen AI.

Resource-Based Policy Guide

Resource-Based Policy Overview

API Gateway’s resource-based policy (Resource-based Policy) is a policy attached to a resource that can determine whether to allow or deny (Effect) actions (Action) on a specific resource only for a principal (Principal). You can directly define the entities that can call the API by using resource-based policies.

Reference
While a typical IAM policy (Identity-based) grants permissions to a user, a resource-based policy is applied to the API itself to allow external access.

Through resource-based policies, you can define the following to allow secure API calls.

  • User of the specified Samsung Cloud Platform account
  • Specified source IP address range or CIDR block

A source policy is defined as a JSON policy document attached to the API, which controls whether the specified security principal (typically an IAM role or group) can invoke the API.

CategoryExplanationexample
Target (Principal)Specify the entity that will call the API-
Task(Action)Define the permitted functions-
ConditionRestrict to allow only in specific situationsAllow only requests from a specific SRN
Table. Entity that controls API call execution
Reference
  • API Gateway’s resource-based policies leverage the rules of IAM’s resource-based policies.
  • To create or modify policies using JSON, refer to JSON Writing Guide.

Resource-based policy usage scenario

The main use cases for resource-based policies are as follows.

Resource-based policy scenario

The resource-based policy scenario used when a specific function of API Gateway operates is as follows.

CategoryExplanationReference example
Default policyThis is the default resource policy that is created by default when an API is created.
  • Users can delete or modify it.
  • It can be recreated after deletion.
Basic policy example
Allowed Account ListYou can define account(s) that can call the API.Account Allowlist Example
IP range blocklistYou can define IP ranges that are not allowed to call the API.IP Range Blocklist Example
Table. Resource-based policy scenario

Additional User Utilization Scenario

Although it is not automatically registered as a resource‑based policy of API Gateway, users can add and use it as needed. The scenarios that users can add and utilize are as follows.

  • Cross-Account Access
    • When an IAM user in account A wants to call account B’s API, add account A to account B’s function policy.
  • Hybrid Access Control
    • You can configure it so that access is allowed only when both conditions are met—a specific user and a specific IP range—rather than simply restricting by account or IP alone.

Managing resource-based policies in API Gateway

To view and configure resource-based policies for API Gateway, follow these steps.

  1. All Services > Application Service > API Gateway Click the menu. 1. Navigate to the Service Home page of API Gateway.
  2. On the Service Home page, click the API Gateway > Resource Policy menu. 2. Navigate to the Resource Policy page.
  3. Click the Edit button of the Policy Details item. 3. Edit Resource Policy popup window opens.
    • When you click the Delete button, the registered policy will be deleted.
  4. Edit Resource Policy In the popup window, after selecting the Policy Template, write the policy.
  5. When the writing is complete, click the Complete button.

Example of resource-based policy

Users can define additional resource-based policies as needed or modify existing policies for use.

Reference
  • For some features, a resource-based policy (or credentials) must be registered to use them in API Gateway.
  • In the resource-based policy example described in this guide, API Gateway automatically registers the example’s resource-based policy when each feature is enabled or linked.

Default policy

This is a policy that is automatically registered when creating an API.

Policy Template

Color mode
{
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:api/{{ApiId}}
      ],
      "Sid": "DefaultStatement"
    }
  ],
  "Version": "2024-07-01"
}
{
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:api/{{ApiId}}
      ],
      "Sid": "DefaultStatement"
    }
  ],
  "Version": "2024-07-01"
}
Example of a basic policy template

Policy example

Color mode
{
  "Statement": [
    
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "DefaultStatement"
    }
  ],
  "Version": "2024-07-01"
}
{
  "Statement": [
    
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "DefaultStatement"
    }
  ],
  "Version": "2024-07-01"
}
Samsung Cloud Platform For Enterprise example
Color mode
{
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "DefaultStatement"
    }
  ],
  "Version": "2024-07-01"
}
{
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "DefaultStatement"
    }
  ],
  "Version": "2024-07-01"
}
Samsung Cloud Platform For Samsung example

Account allow list

This policy allows only users of a specific SCP account (Root user or IAM Role) to invoke the API.

Policy Template

Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:method/{{ApiId}}/{{stageNameOrWildcard*}}/{{httpVerbOrWildcard*}}/{{resourcePathOrWildcard*}}
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:{{Offering}}::{{AccountID}}:::iam:user/{{UserSrn}}
        ]
      },
      "Resource": [
        srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:api/{{ApiId}}
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:method/{{ApiId}}/{{stageNameOrWildcard*}}/{{httpVerbOrWildcard*}}/{{resourcePathOrWildcard*}}
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:{{Offering}}::{{AccountID}}:::iam:user/{{UserSrn}}
        ]
      },
      "Resource": [
        srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:api/{{ApiId}}
      ],
      "Sid": "Statement1"
    }
  ]
}
Example of an account allowlist policy template

Policy example

Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:e::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:e::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Enterprise example
Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:s::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:s::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:s::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:s::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Samsung example

IP range block list

It is a policy that allows or blocks only specific IP addresses or CIDR ranges.

Policy Template

Color mode
{
  "Version": ""
  "Statement": [
    
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            "srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:method/{{ApiId}}/{{stageNameOrWildcard*}}/{{httpVerbOrWildcard*}}/{{resourcePathOrWildcard*}}"
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            {{sourceIpOrCIDRBlock}}
            {{sourceIpOrCIDRBlock}}
          ]
        }
      },
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:api/{{ApiId}}
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            "srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:method/{{ApiId}}/{{stageNameOrWildcard*}}/{{httpVerbOrWildcard*}}/{{resourcePathOrWildcard*}}"
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            {{sourceIpOrCIDRBlock}}
            {{sourceIpOrCIDRBlock}}
          ]
        }
      },
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:{{Offering}}::{{AccountID}}:kr-west1::apigateway:api/{{ApiId}}
      ],
      "Sid": "Statement1"
    }
  ]
}
Example of IP Range Blocklist Policy Template

Policy example

Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Enterprise example
Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:s::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:s::accountId1:kr-west1::apigateway:method/apiId1/stage1/GET/resource1
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": "*"
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Samsung example

Cross-Account Access

This is a resource policy that allows a user of account B to call a specific API resource of account A.

Policy example

Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/*/*/*
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:e::accountId1:::iam:user/userId1
          "srn:e::accountId2:::iam:user/userId2"
        ]
      },
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/*/*/*
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:e::accountId1:::iam:user/userId1
          "srn:e::accountId2:::iam:user/userId2"
        ]
      },
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Enterprise example
Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:s::accountId1:kr-west1::apigateway:method/apiId1/*/*/*
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:s::accountId1:::iam:user/userId1
          "srn:s::accountId2:::iam:user/userId2"
        ]
      },
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
      "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:s::accountId1:kr-west1::apigateway:method/apiId1/*/*/*
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:s::accountId1:::iam:user/userId1
          "srn:s::accountId2:::iam:user/userId2"
        ]
      },
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Samsung example

Hybrid Access Control

It is a resource policy that can define access control policies by combining user credentials (Account) and connection source (IP).

Policy example

Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
       "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/*/*/*
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:e::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
       "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            srn:e::accountId1:kr-west1::apigateway:method/apiId1/*/*/*
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:e::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:e::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Enterprise example
Color mode
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
       "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            "srn:s::accountId1:kr-west1::apigateway:method/apiId1/*/*/*"
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:s::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
{
  "Version": ""
  "Statement": [
    {
      "Action": [
        apigateway:InvokeApigatewayRegion
      ],
       "Condition": {
        "SrnLike": {
          "scp:RequestAttribute/body['method-srn']": [
            "srn:s::accountId1:kr-west1::apigateway:method/apiId1/*/*/*"
          ]
        },
        "NotIpAddress": {
          "scp:SourceIp": [
            "1.2.3.4/24"
            5.6.7.8/32
          ]
        }
      },
      "Effect": "Allow"
      "Principal": {
        "scp": [
          srn:s::accountId1:::iam:user/userId1
        ]
      },
      "Resource": [
        srn:s::accountId1:kr-west1::apigateway:api/apiId1
      ],
      "Sid": "Statement1"
    }
  ]
}
Samsung Cloud Platform For Samsung example
How-to guides
Release Note