By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Add policy for private app sync in VPC endpoint?

0

Hello,

What policy can we add in vpc endpoint to control access to private appsync. I need to add policy for EKS IRSA role in VPC endpoint. Does this kind of VPC endpoint policy work. I am unable to find any document on google for this.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::account-id:role/your-irsa-role",
                    "arn:aws:iam::account-id:user/your-user"
                ]
            },
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:region:account-id:appsync-api-id/*"
        }
    ]
}
Topics
ServerlessFront-End Web & MobileApplication IntegrationNetworking & Content DeliverySecurity, Identity, & Compliance
Tags
AWS AppSyncAmazon VPCAWS PrivateLinkIAM Policies
Language
English
Tanul
asked 8 days ago131 views
1 Answer
0

The policy you shared seems to be for an API Gateway, not for AppSync. For AppSync, you would typically use an interface VPC endpoint.

When using the EKS module, you should specify the service_account_role_arn under the vpc-cni addon and not attach the cni_policy to the node role. This is how you can use an IRSA role with EKS.

profile picture
EXPERT
Giovanni Lauria
answered 8 days ago
  • Tanul
    8 days ago

    Thank you so much for replying. So currently, we have EKS with IRSA role enabled. I have added this in role

    { "Action": [ "appsync:GraphQL" ], "Effect": "Allow", "Resource": [ "arn:aws:appsync:region:account:apis/appsync id" ]

    Now, I have created a vpc privatelink/endpoint. While creating that an option came to select full policy or custom policy. In custom policy what should I add as my organization is not allowing me to select Full access?

Relevant content