AWS apigateway high security documentation change

Service: apigateway · 2025-10-10 · Security-related high

File: apigateway/latest/developerguide/apigateway-private-custom-dom-domains-provider-share.md

Summary

Updated IAM policy to replace execute-api:Invoke permissions with apigateway:CreateAccessAssociation, added organization ID condition, and tightened resource restrictions

Security assessment

The change replaces broad execute-api:Invoke permissions with more specific apigateway:CreateAccessAssociation action, adds PrincipalOrgID condition for organizational access control, and restricts resources to specific ARNs. This reduces attack surface and enforces least privilege, directly improving security posture.

Diff