Circular dependency in configuring access policy of execute-api vpc endpoint to allow only specific API Gateway

17 Views Asked by At

I need to create a private REST API which uses execute-api VPC endpoint to trigger lambdas. All the VPC endpoints are managed by cloud team in the organisation so they will create the endpoint for us and we will use it using data resource aws_vpc_endpoint of terraform.

We need rest api id in the VPC enpoint resource policy to allow only a specific API Gateway rest API.

{
    "Statement": [
        {
            "Principal": "*",
            "Action": [
                "execute-api:Invoke"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:execute-api:us-east-1:123412341234:{rest_api_id}/*",
                "arn:aws:execute-api:us-east-1:123412341234:{rest_api_id}/*"
            ]
        }
    ]
}

and we need vpc enpoint id to create rest API:

resource "aws_api_gateway_rest_api" "example" {
  name              = "example"
  put_rest_api_mode = "merge"

  endpoint_configuration {
    types            = ["PRIVATE"]
    vpc_endpoint_ids = [data.aws_vpc_endpoint.example.id]
  }
}

It looks like a circular dependency to me.

How should be handle this in our terraform code?

0

There are 0 best solutions below