Help Center/ API Gateway/ User Guide/ Permissions Management/ Creating a User and Granting API Gateway Permissions

Updated on 2022-09-26 GMT+08:00

View PDF

Creating a User and Granting API Gateway Permissions

This topic describes how to use Identity and Access Management (IAM) to implement permissions control for your API Gateway resources. With IAM, you can:

Create IAM users for employees based on your enterprise's organizational structure. Each IAM user will have their own security credentials for accessing API Gateway resources.
Grant only the permissions required for users to perform a specific task.
Entrust an account or a cloud service to perform O&M on your API Gateway resources.

If your account does not require individual IAM users, skip this chapter.

This section describes the procedure for granting permissions (see Figure 1).

Prerequisites

Learn about the permissions (see Table 1) supported by API Gateway and choose policies or roles according to your requirements. For the permissions of other services, see "System Permissions".

**Table 1** System-defined roles and policies supported by APIG
Role/Policy Name	Description	Type	Dependency
APIG Administrator	Administrator permissions for APIG. Users granted these permissions can use all functions of dedicated gateways.	System-defined role	None
APIG FullAccess	Full permissions for APIG. Users granted these permissions can use all functions of dedicated gateways.	System-defined policy	None
APIG ReadOnlyAccess	Read-only permissions for APIG. Users granted these permissions can only view dedicated gateways.	System-defined policy	None

Process Flow

Figure 1 Process for granting API Gateway permissions

Create a user group and assign permissions.
Create a user group on the IAM console, and attach the APIG Administrator role or the APIG FullAccess policy to the group.
Create an IAM user.
Create a user on the IAM console and add the user to the group created in 1.
Log in and verify permissions.
Log in to the API Gateway console as the created user, and verify that the user has administrator permissions for API Gateway.