Discover AWS Gateway APIs in Service Catalog with the Konnect UI

Uses: Service Catalog Konnect API

Incompatible with

on-prem

Prerequisites

Kong Konnect

If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

The following Konnect items are required to complete this tutorial:
- Personal access token (PAT): Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.
Set the personal access token as an environment variable:
```
export KONNECT_TOKEN='YOUR KONNECT TOKEN'
```
Copied!

Konnect roles

You need the Integration Admin role in Konnect to install and authorize Service Catalog integrations.

AWS API Gateway

You need a REST API in AWS API Gateway to ingest and a correctly configured IAM role for this integration. You can name your AWS API Gateway API whatever you’d like. In this tutorial, we’ll refer to your AWS API Gateway API as aws-api.

You can follow the setup instructions in the UI wizard when you add the AWS API Gateway instance or do the following:

If you want to use the AWS console UI, follow the steps in Amazon’s Creating an IAM role (console) documentation. Make sure to select Another AWS account and enter the Account ID (auto gen id here) and select Require external ID and enter the External ID (external id here). Navigate to the role in the console UI and copy the ARN to use in Konnect.

In the AWS console, navigate to the IAM settings.
In the IAM sidebar, click Policies.
Click Create policy.
For the Policy editor settings, click JSON.

In the Policy editor field, enter the following:

{
    "Version": "2012-10-17",
    "Statement": [
      { "Sid": "ApiGwRead",
        "Effect": "Allow",
        "Action": ["apigateway:GET"],
        "Resource": "*"
      }
    ]
  }

Copied!

Click Next.
In the Policy name field, enter konnect-service-catalog-permissions.
Click Create policy.
In the IAM sidebar, click Roles.
Click Create role.
For the Trusted entity type, select AWS account.
For the AWS account settings, select Another AWS account.
In the Account ID field, enter 333402130851.

This is Konnect’s account ID that is used for the IAM role principal.
Select the Require external ID checkbox.
In the External ID field, enter your Konnect organization ID. You can find this by sending a GET request to /organizations/me or in the Konnect UI by navigating to your account in the top right and clicking the copy icon next to your organization name.
Click Next.
From the Permissions policies list, select konnect-service-catalog-permissions.
Click Next.
In the Role name field, enter konnect-service-catalog-integration.
Click Create role.

View the konnect-service-catalog-integration you just created and copy the ARN.

Get your Konnect org ID:

 curl -X GET "https://global.api.konghq.com/v3/organizations/me" \
     -H "Authorization: Bearer $KONNECT_TOKEN"

Copied!

This is used for the external ID in the AWS IAM role

Export your Konnect org ID:
```
export EXTERNAL_ID='YOUR-ORG-ID'
```
Copied!
Export the Konnect account ID:
```
export ACCOUNT_ID='333402130851'
```
Copied!
This is Konnect’s account ID that is used for the IAM role principal.
Configure and authenticate with AWS:
```
aws configure
```
Copied!

Create the Service Catalog IAM role:

aws iam create-role \
  --role-name konnect-service-catalog-integration \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Principal": { "AWS": "'$ACCOUNT_ID'" },
        "Condition": { "StringEquals": { "sts:ExternalId": "'$EXTERNAL_ID'" } }
      }
    ]
  }' \
  --description "Service Catalog integration role"

Copied!

Copy and save your ARN from the output to add it to Konnect.

Configure the permissions policy on the role:

aws iam put-role-policy \
  --role-name konnect-service-catalog-integration \
  --policy-name konnect-service-catalog-permissions \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      { "Sid": "CloudWatchRead",
        "Effect": "Allow",
        "Action": ["cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics"],
        "Resource": "*"
      },
      { "Sid": "ApiGwRead",
        "Effect": "Allow",
        "Action": ["apigateway:GET"],
        "Resource": "*"
      }
    ]
  }'

Copied!

Configure the AWS API Gateway integration

Before you can discover APIs in Service Catalog, you must configure the AWS API Gateway integration.

In the Konnect sidebar, click Service Catalog.
In the Service Catalog sidebar, click Integrations.
Click AWS API Gateway.
Click Add AWS API Gateway instance.
From the AWS region dropdown, select “US East (Ohio)”. If you’re using a different region, select your region from the dropdown.
In the IAM role ARN field, enter the IAM role you configured for Service Catalog.
In the Display name field, enter aws-api-gateway-test.
In the Instance name field, enter aws-api-gateway-test.
Click Save.

Create a Service Catalog service and map the API resources

Now that your integration is configured, you can create a Service Catalog service to map the ingested APIs.

In this tutorial, we’ll refer to your ingested AWS API Gateway API as aws-api.

In the Konnect sidebar, click Service Catalog.
Click New service.
In the Display Name field, enter APIs.
In the Name field, enter apis.
Click Create.
Click Map Resources.
Select aws-api.
Click Map 1 Resource.

Your integration APIs are now discoverable from one Service Catalog service.

You might need to manually sync your AWS API Gateway integration for resources to appear. From the Konnect UI by navigating to the AWS API Gateway integration you just installed and selecting Sync Now from the Actions dropdown menu.

Validate the mapping

To confirm that the AWS API Gateway resource is now mapped to the intended service, navigate to the service:

In the Konnect sidebar, click Service Catalog.
In the Service Catalog sidebar, click Services.
Click the APIs service.
Click the Resources tab.

You should see the aws-api resource listed.

Discover AWS Gateway APIs in Service Catalog with the Konnect UI

Prerequisites

Kong Konnect

Konnect roles

AWS API Gateway

Configure the AWS API Gateway integration

Create a Service Catalog service and map the API resources

Validate the mapping

Help us make these docs great!

Still need help