Learn AWS Serverless Computing

IAM permissions and policies

The first option to cover is the IAM authentication method for securing APIs. To clarify, there are two main ways to use IAM:

• The first is to provide administrative access to create, update, maintain, and delete APIs.
• The second is to control which entities can invoke or execute an existing API—this is the component that this section is focused on.

The benefit of using IAM for access control is that it centralizes our authentication and authorization concerns to a single service. Those of us who have been using AWS for a while will also be very familiar with the IAM service as it is integrated with almost everything. Changes we make to roles or policies can also be made without redeploying any API code, and ...