AWS API Gateway

If you want to use the AWS console UI, follow the steps in Amazon’s Creating an IAM role (console) documentation. Make sure to select Another AWS account and enter the Account ID (auto gen id here) and select Require external ID and enter the External ID (external id here). Navigate to the role in the console UI and copy the ARN to use in Konnect.

1. In the AWS console, navigate to the IAM settings.
2. In the IAM sidebar, click Policies.
3. Click Create policy.
4. For the Policy editor settings, click JSON.

5. In the Policy editor field, enter the following:

   {
       "Version": "2012-10-17",
       "Statement": [
         { "Sid": "ApiGwRead",
           "Effect": "Allow",
           "Action": ["apigateway:GET"],
           "Resource": "*"
         }
       ]
     }
   

   Copied!
6. Click Next.
7. In the Policy name field, enter konnect-service-catalog-permissions.
8. Click Create policy.
9. In the IAM sidebar, click Roles.
10. Click Create role.
11. For the Trusted entity type, select AWS account.
12. For the AWS account settings, select Another AWS account.

13. In the Account ID field, enter 333402130851.

    This is Konnect’s account ID that is used for the IAM role principal.

14. Select the Require external ID checkbox.
15. In the External ID field, enter your Konnect organization ID. You can find this by sending a GET request to /organizations/me or in the Konnect UI by navigating to your account in the top right and clicking the copy icon next to your organization name.
16. Click Next.
17. From the Permissions policies list, select konnect-service-catalog-permissions.
18. Click Next.
19. In the Role name field, enter konnect-service-catalog-integration.
20. Click Create role.

View the konnect-service-catalog-integration you just created and copy the ARN.