API Gateway
Terraform module to create AWS API Gateway v2 (HTTP/WebSocket)
Inputs
40 / 43
api_key_selection_expressionoptionalstringAn API key selection expression. Valid values: `$context.authorizer.usageIdentifierKey`, `$request.header.x-api-key`. Defaults to `$request.header.x-api-key`. Applicable for WebSocket APIs
nullapi_mapping_keyoptionalstringThe [API mapping key](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-websocket-api-mapping-template-reference.html)
nullapi_versionoptionalstringA version identifier for the API. Must be between 1 and 64 characters in length
nullauthorizersoptionalmap(object({ authorizer_credentials_arn = optional(string) authorizer_payload_fo…Map of API gateway authorizers to create
{}bodyoptionalstringAn OpenAPI specification that defines the set of routes and integrations to create as part of the HTTP APIs. Supported only for HTTP APIs
nullcors_configurationoptionalobject({ allow_credentials = optional(bool) allow_headers = optional(list(string…The cross-origin resource sharing (CORS) configuration. Applicable for HTTP APIs
nullcreateoptionalboolControls if resources should be created
truecreate_certificateoptionalboolWhether to create a certificate for the domain. Since certificate validate only works on public domains, this will be ignore if `private_zone` is set to `true`
truecreate_domain_nameoptionalboolWhether to create API domain name resource
truecreate_domain_recordsoptionalboolWhether to create Route53 records for the domain name
truecreate_routes_and_integrationsoptionalboolWhether to create routes and integrations resources
truecreate_stageoptionalboolWhether to create default stage
truecredentials_arnoptionalstringPart of quick create. Specifies any credentials required for the integration. Applicable for HTTP APIs
nulldeploy_stageoptionalboolWhether to deploy the stage. `HTTP` APIs are auto-deployed by default
truedescriptionoptionalstringThe description of the API. Must be less than or equal to 1024 characters in length
nulldisable_execute_api_endpointoptionalboolWhether clients can invoke the API by using the default execute-api endpoint. By default, clients can invoke the API with the default `{api_id}.execute-api.{region}.amazonaws.com endpoint`. To require that clients use a custom domain name to invoke the API, disable the default endpoint
nulldomain_nameoptionalstringThe domain name to use for API gateway
""domain_name_certificate_arnoptionalstringThe ARN of an AWS-managed certificate that will be used by the endpoint for the domain name. AWS Certificate Manager is the only supported source
nulldomain_name_ownership_verification_certificate_arnoptionalstringARN of the AWS-issued certificate used to validate custom domain ownership (when certificate_arn is issued via an ACM Private CA or mutual_tls_authentication is configured with an ACM-imported certificate.)
nullfail_on_warningsoptionalboolWhether warnings should return an error while API Gateway is creating or updating the resource using an OpenAPI specification. Defaults to `false`. Applicable for HTTP APIs
nullhosted_zone_nameoptionalstringOptional domain name of the Hosted Zone where the domain should be created
nullip_address_typeoptionalstringThe IP address types that can invoke the API. Valid values: ipv4, dualstack. Use ipv4 to allow only IPv4 addresses to invoke your API, or use dualstack to allow both IPv4 and IPv6 addresses to invoke your API. Defaults to ipv4.
nullmutual_tls_authenticationoptionalmap(string)The mutual TLS authentication configuration for the domain name
{}nameoptionalstringThe name of the API. Must be less than or equal to 128 characters in length
""private_zoneoptionalboolIndicates the hosted zone being looked up is private. Certificate validation will fail if this is set to true.
falseprotocol_typeoptionalstringThe API protocol. Valid values: `HTTP`, `WEBSOCKET`
HTTPregionoptionalstringRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
nullroute_keyoptionalstringPart of quick create. Specifies any route key. Applicable for HTTP APIs
nullroute_selection_expressionoptionalstringThe route selection expression for the API. Defaults to `$request.method $request.path`
nullroutesoptionalmap(object({ # Route authorizer_key = optional(string) api_key_required = option…Map of API gateway routes with integrations
{}stage_access_log_settingsoptionalobject({ create_log_group = optional(bool, true) destination_arn = optional(stri…Settings for logging access in this stage. Use the aws_api_gateway_account resource to configure [permissions for CloudWatch Logging](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html#set-up-access-logging-permissions)
{}stage_client_certificate_idoptionalstringThe identifier of a client certificate for the stage. Use the `aws_api_gateway_client_certificate` resource to configure a client certificate. Supported only for WebSocket APIs
nullstage_default_route_settingsoptionalobject({ data_trace_enabled = optional(bool, true) detailed_metrics_enabled = op…The default route settings for the stage
{}stage_descriptionoptionalstringThe description for the stage. Must be less than or equal to 1024 characters in length
nullstage_nameoptionalstringThe name of the stage. Must be between 1 and 128 characters in length
$defaultstage_tagsoptionalmap(string)A mapping of tags to assign to the stage resource
{}stage_variablesoptionalmap(string)A map that defines the stage variables for the stage
{}subdomain_record_typesoptionallist(string)A list of record types to create for the subdomain(s)
[…]subdomainsoptionallist(string)An optional list of subdomains to use for API gateway
[]tagsoptionalmap(string)A mapping of tags to assign to API gateway resources
{}All 43 are optional — the module deploys with none of them set. Showing 40, so the site stays a static download — the remaining 3 are in the source.
Outputs
22
acm_certificate_arnThe ARN of the certificate
api_arnThe ARN of the API
api_endpointURI of the API, of the form `https://{api-id}.execute-api.{region}.amazonaws.com` for HTTP APIs and `wss://{api-id}.execute-api.{region}.amazonaws.com` for WebSocket APIs
api_execution_arnThe ARN prefix to be used in an `aws_lambda_permission`'s `source_arn` attribute or in an `aws_iam_policy` to authorize access to the `@connections` API
api_idThe API identifier
authorizersMap of API Gateway Authorizer(s) created and their attributes
domain_name_api_mapping_selection_expressionThe API mapping selection expression for the domain name
domain_name_arnThe ARN of the domain name
domain_name_configurationThe domain name configuration
domain_name_hosted_zone_idThe Amazon Route 53 Hosted Zone ID of the endpoint
domain_name_idThe domain name identifier
domain_name_target_domain_nameThe target domain name
integrationsMap of the integrations created and their attributes
routesMap of the routes created and their attributes
stage_access_logs_cloudwatch_log_group_arnArn of cloudwatch log group created
stage_access_logs_cloudwatch_log_group_nameName of cloudwatch log group created
stage_arnThe stage ARN
stage_domain_nameDomain name of the stage (useful for CloudFront distribution)
stage_execution_arnThe ARN prefix to be used in an aws_lambda_permission's source_arn attribute or in an aws_iam_policy to authorize access to the @connections API
stage_idThe stage identifier
stage_invoke_urlThe URL to invoke the API pointing to the stage
vpc_linksMap of VPC links created and their attributes
What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.