Policy

gistfile1.txt

const authRole = iam.Role.fromRoleArn(this, 'AuthRole', `arn:aws:iam::${Stack.of(this).region}:${Stack.of(this).account}:role/CognitoDefaultAuthenticatedRole`);

// Policy for Cognito invoking API Gateway
new iam.Policy(this, `${repositoryName}-Policy`, {
  policyName: `${repositoryName}-Policy`,
  roles: [authRole],
  statements: [
    new iam.PolicyStatement({
      effect: iam.Effect.ALLOW,
      resources: [
        `arn:aws:execute-api:${Stack.of(this).region}:${Stack.of(this).account}:${apigatewaysocket.ref}/*/$connect`
      ],
      actions: [            
        'execute-api:Invoke'
      ]
    }),
    new iam.PolicyStatement({
      effect: iam.Effect.DENY,
      resources: [
        `arn:aws:execute-api:${Stack.of(this).region}:${Stack.of(this).account}:${apigatewaysocket.ref}/*/secret`
      ],
      actions: [            
        'execute-api:Invoke'
      ]
    }),
    new iam.PolicyStatement({
      effect: iam.Effect.DENY,
      resources: [
        `arn:aws:execute-api:${Stack.of(this).region}:${Stack.of(this).account}:${apigatewaysocket.ref}/*`
      ],
      actions: [            
        'execute-api:ManageConnections'
      ]
    })
  ]
});