Expose execution ARN from aws_api_gateway_rest_api resource

[mewa]

Hi,

Currently, in order to create for example a Lambda permission for API Gateway one has to create an aws_api_gateway_deployment resource and obtain the execution_arn attribute.

resource "aws_lambda_permission" "lambda_permission" {
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = "example_lambda"
  principal     = "apigateway.amazonaws.com"

  source_arn = "${aws_api_gateway_deployment.example_deployment.execution_arn}/*/*"
}

However, this approach couples the deployment (stage) with specific permission.

Alternatively one could use a block like this

  source_arn = "${replace(aws_api_gateway_deployment.example_deployment.execution_arn, format("/%s$/", aws_api_gateway_deployment.example_deployment.stage_name), "*")}/*/*"

to calculate the ARN not restricted to specific stage, or even create the ARN by hand according to the specification.

But either way we end up with messy expressions and/or permission coupled to the deployment.

I feel that the aws_api_gateway_rest_api resource should expose execution_arn in a fashion similar to aws_api_gateway_deployment.

[tdmalone]

I'd also love to see the arn exposed - which I think is different to the execution ARN (should I lodge a separate issue?) Currently the id is exposed, but to build the arn you need to do something like:

"arn:aws:apigateway:${data.aws_region.current.name}::/restapis/${aws_api_gateway_rest_api.api.id}"

[bflad]

Support for this has been merged in via #3968 and will release with v1.19.0 of the AWS provider, likely middle of next week.

@tdmalone yes please 😄 Should be a very similar PR to this one

[bflad]

This has been released in version 1.19.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!