This message was deleted.

Hi Chad, Rather than specifying a separate

RestApiPolicy

, there is an extra property available in `restApiArgs`called policy. Looking at the docs I think it does the same as the

RestApiPolicy

. It takes a policy as json but you can do something like the following (this is an example policy so obviously swap it for your own one):

const policy = aws.iam.getPolicyDocument({
        statements: [{
            actions: ["dynamodb:*"],
            effect: "Allow",
            resources: ["*"]
        }]
});

const api = new awsx.apigateway.API("my-api",{
    routes: [{
        path: "/",
        method: "GET",
        eventHandler: async (event) => {
            // This code runs in an AWS Lambda and will be invoked any time `/` is hit.
            return {
                statusCode: 200,
                body: "hello",
            };
        },
    }],
    restApiArgs: {
        endpointConfiguration: {
            types: "PRIVATE", 
            vpcEndpointIds: [execApiVpcEndpointId]    
        },
        policy: policy.then(policy => policy.json)
    },
});

Try that and let me know if it works

Hi @brave-planet-10645 I tried the policy on restApiArgs first. It doesn't work. Now what?

Didn't work as in there was an error when updating the stack, or when you tried to call the api endpoint, or something else?

The stack wouldn't deploy. "Can't deploy private API Gateway without a RestApiPolicy"

ok. So the reason that you can deploy it but only in two steps is because of the way these are linked together.

First deploy fails the deploy phase of the APIGW because there is no RestApiPolicy. However the policy finishes deploying during the first deploy. So the second pulumi up succeeds and deploys the APIGW because there is now a policy. Hack-o-rama

If you were to use the base aws package and create an apigateway using that rather than the awsx package (which does a lot of magic under the hood) you'll probably fine that you'll be able to do this because you can set up the api gateway first, then set up the restapipolicy and then whatever else needs to happen to link the apigateway to the vpc endpoint

I would like to pass the policy in, have the crosswalk deploy it before the APIGW deploy phase, and have it work in one shot.

Crosswalk was created to make common IAAC tasks easier. This is one that we haven't been asked for before. I can see you've raised an issue so that'll bring it to the attention of our engineering team.

Cool. I'll see if I can or get somebody to do a simple PR to apply the policy that's being passed in.

that would be awesome

Hi @brave-planet-10645 Somebody pushed a PR for this. However, I still have to run

pulumi up

twice on the initial deploy. Subsequent deploys work on a single run, weird.