Package: awscli-plugin-execute-api
awscli-plugin-execute-apiPlugin to configure a single AWS CLI operation to invoke an API Gateway / Lambda methodQuick StartInstall with pip$pipinstallawscli-plugin-execute-apiIf you installedawscliwith Homebrew, use its bundled Python:$/usr/local/opt/awscli/libexec/bin/pipinstallawscli-plugin-execute-apiRegister the plugin$awsconfiguresetplugins.execute-apiawscli_plugin_execute_apiConfigure an operation endpointFirst configure a profile for the IAM withexecute-api:Invokepermission:$exportAWS_PROFILE=myprofile

$awsconfigure
AWSAccessKeyID[None]:AKIA...
AWSSecretAccessKey[None]:pWim...
Defaultregionname[None]:us-east-1
Defaultoutputformat[None]:jsonNext configure the plugin for an operation and its API Gateway invocation URL:$awsconfiguresetdynamodb.update-tablehttps://m303r7o808.execute-api.us-east-1.amazonaws.com/Prod/update-tableYou can review or manually configure `$HOME/.aws/config`...[plugins]
execute-api = awscli_plugin_execute_api

[profile myprofile]
region = us-east-1
output = json
dynamodb =
    update-table = https://m303r7o808.execute-api.us-east-1.amazonaws.com/Prod/update-tableRun an operationNow run a command:$awsdynamodbupdate-table--table-name$TABLE_NAME--sse-specificationEnabled=falseAnerroroccurred(ValidationException)whencallingtheUpdateTableoperation:CustomerrorfromLambdahandlerYou can use the `--debug` flag to verify the endpoint...$awsdynamodbupdate-table--debug--table-name$TABLE_NAMEPluginawscli_plugin_execute_api:Config[myprofile]dynamodb.update-table=>URLhttps://m303r7o808.execute-api.us-east-1.amazonaws.com/Prod/update-table
Pluginawscli_plugin_execute_api:renamedX-Amz-TargetDynamoDB_20120810.UpdateTable

$awsdynamodbdescribe-table--debug--table-name$TABLE_NAMEPluginawscli_plugin_execute_api:Config[myprofile]dynamodb.describe-tablenotfoundMotivationFor security reasons we'd like to give an IAM user access to alimited subsetof an AWS API call functionality. For example on thedynamodb update-tableoperation we'd like to allow a user to modify:Global indexesBut disallow them to modify:Provisioned throughputStreamsServer side encryptionA "serverless" solution includes:IAM UserPolicy that disallowsdynamodb:UpdateTablePolicy that allowsexecute-api:Invokeon an API Gateway resourceAccess keysAPI Gateway MethodURL to POST anupdate-tablerequestAWS_IAM authorizationLambda FunctionPolicy that allowsdynamodb:UpdateTableCode that validates and performsupdate-tablerequestAWS CLICustom endpoint URL fordynamodb update-tablecommandRequest signature for API GatewayThis plugin registers a URL for a single CLI operation and automatically uses it.$awsconfiguresetdynamodb.update-tablehttps://m303r7o808.execute-api.us-east-1.amazonaws.com/Prod/update-table
$awsdynamodbupdate-table--table-name$TABLE_NAME--sse-specificationEnabled=falseAnerroroccurred(ValidationException)whencallingtheUpdateTableoperation:ModifyingSSESpecificationisnotallowedTroubleshootingIAMThe CLI user needsAPI execution permissions:{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["execute-api:Invoke"],"Resource":["arn:aws:execute-api:us-east-1:303718836660:m303r7o808/*/POST/update-table"]}]}LambdaThe CLI operation is in theX-Targetheader, sinceX-Amz-TargetCreditshttps://github.com/wbingli/awscli-plugin-endpoint