<p>I was dealing with a similar issue. Ultimately, the following worked for me:</p>
<pre class="lang-json prettyprint-override"><code>{
  &quot;Effect&quot;: &quot;Allow&quot;,
  &quot;Action&quot;: [
    &quot;apigateway:POST&quot;,
    &quot;apigateway:TagResource&quot;
  ],
  &quot;Resource&quot;: [
    &quot;arn:aws:apigateway:*::/apis&quot;,
    &quot;arn:aws:apigateway:*::/apis/*/stages&quot;
  ],
  &quot;Condition&quot;: {
    &quot;StringEquals&quot;: {
      &quot;aws:RequestTag/WbyProjectName&quot;: [
        &quot;webiny-js&quot;
      ]
    }
  }
}
</code></pre>

CC BY-SA 4.0
2022-12-09T06:23:25.503Z
Cool, but we'll get the below error in the I am policy visual editor right?


"Invalid Action: The action apigateway:TagResource does not exist."

did you just ignore that ?
DilLip_Chowdary
CC BY-SA 4.0
2023-05-19T02:11:19.537Z
@DilLip_Chowdary yea, I ignored it and it worked, I think the editor checker hasn't been updated to include newer actions
Jun
CC BY-SA 4.0
2022-12-08T15:16:40.120Z
2022-12-08T15:16:40.120Z
Adrian
<p>AWS threw a below error saying the user doesn't have access to <code>apigateway:TagResource</code> permission, but when I checklist of available permissions in the IAM console, I'm not able to find any such permission.</p>
<pre><code>xxxx is not authorized to perform: apigateway:TagResource on resource xxx
</code></pre>
<p>Currently, I've given the below permissions for that API.</p>
<pre class="lang-json prettyprint-override"><code>{
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: [
        &quot;apigateway:DELETE&quot;,
        &quot;apigateway:PUT&quot;,
        &quot;apigateway:PATCH&quot;,
        &quot;apigateway:POST&quot;,
        &quot;apigateway:GET&quot;
    ],
    &quot;Resource&quot;: [
        &quot;arn:aws:apigateway:*::/restapis*&quot;,
        &quot;arn:aws:apigateway:*::/apikeys*&quot;,
        &quot;arn:aws:apigateway:*::/usageplans*&quot;,
        &quot;arn:aws:apigateway:*::/domainnames*&quot;,
        &quot;arn:aws:apigateway:*::/tags*&quot;,
        &quot;arn:aws:apigateway:*::/apis*&quot;
    ],
    &quot;Condition&quot;: {
        &quot;StringLikeIfExists&quot;: {
            &quot;apigateway:Request/apiName&quot;: &quot;my-api*&quot;
        }
    }
}
</code></pre>
<p>How to resolve this, any other permission is required?</p>

CC BY-SA 4.0
2022-11-16T10:31:32.343Z
Remove the condition block and add the explicit name of resource specified in the error, and then ensure, to add tagResouces permission in the Action block, retry and lets see
saviour123
CC BY-SA 4.0
2022-11-16T10:34:37.910Z
there is no such permission like `apigateway:TagResource`, I'm struggling with it.
DilLip_Chowdary
CC BY-SA 4.0
2022-11-16T10:40:14.610Z
replace all this         "apigateway:DELETE",
        "apigateway:PUT",
        "apigateway:PATCH",
        "apigateway:POST",
        "apigateway:GET" with "apigateway:*" try and lets see
saviour123
CC BY-SA 4.0
2022-11-17T12:38:53.730Z
Yeah, i tried that earlier, it's working, but how to specify the required permission instead of wildcard?
DilLip_Chowdary
<amazon-web-services><aws-iam><api-gateway>
IAM Permissions issue in API Gateway Deployment
DilLip_Chowdary
# IAM Permissions issue in API Gateway Deployment

(Asked by: username_0 on 2022-11-15)

AWS threw a below error saying the user doesn't have access to apigateway:TagResource permission, but when I checklist of available permissions in the IAM console, I'm not able to find any such permission.
xxxx is not authorized to perform: apigateway:TagResource on resource xxx

Currently, I've given the below permissions for that API.
{
    "Effect": "Allow",
    "Action": [
        "apigateway:DELETE",
        "apigateway:PUT",
        "apigateway:PATCH",
        "apigateway:POST",
        "apigateway:GET"
    ],
    "Resource": [
        "arn:aws:apigateway:*::/restapis*",
        "arn:aws:apigateway:*::/apikeys*",
        "arn:aws:apigateway:*::/usageplans*",
        "arn:aws:apigateway:*::/domainnames*",
        "arn:aws:apigateway:*::/tags*",
        "arn:aws:apigateway:*::/apis*"
    ],
    "Condition": {
        "StringLikeIfExists": {
            "apigateway:Request/apiName": "my-api*"
        }
    }
}

How to resolve this, any other permission is required?

**Tags:** amazon-web-services, aws-iam, api-gateway

> **Comments:**
> **username_1**: Remove the condition block and add the explicit name of resource specified in the error, and then ensure, to add tagResouces permission in the Action block, retry and lets see  
> **username_0**: there is no such permission like `apigateway:TagResource`, I'm struggling with it.  
> **username_1**: replace all this         "apigateway:DELETE",         "apigateway:PUT",         "apigateway:PATCH",         "apigateway:POST",         "apigateway:GET" with "apigateway:*" try and lets see  
> **username_0**: Yeah, i tried that earlier, it's working, but how to specify the required permission instead of wildcard?  

---

## 1 answers

### Answer by username_2 on 2022-12-08. Score: 1 | Accepted answer

I was dealing with a similar issue. Ultimately, the following worked for me:
{
  "Effect": "Allow",
  "Action": [
    "apigateway:POST",
    "apigateway:TagResource"
  ],
  "Resource": [
    "arn:aws:apigateway:*::/apis",
    "arn:aws:apigateway:*::/apis/*/stages"
  ],
  "Condition": {
    "StringEquals": {
      "aws:RequestTag/WbyProjectName": [
        "webiny-js"
      ]
    }
  }
}

> **Comments:**
> **username_0**: Cool, but we'll get the below error in the I am policy visual editor right?   "Invalid Action: The action apigateway:TagResource does not exist."  did you just ignore that ?  
> **username_3**: @username_0 yea, I ignored it and it worked, I think the editor checker hasn't been updated to include newer actions  

---

