AWS::ApiGateway::Account - Amazon CloudFormation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).


The AWS::ApiGateway::Account resource specifies the IAM role that Amazon API Gateway uses to write API logs to Amazon CloudWatch Logs. To avoid overwriting other roles, you should only have one AWS::ApiGateway::Account resource per region per account.


To declare this entity in your Amazon CloudFormation template, use the following syntax:


{ "Type" : "AWS::ApiGateway::Account", "Properties" : { "CloudWatchRoleArn" : String } }


Type: AWS::ApiGateway::Account Properties: CloudWatchRoleArn: String



The ARN of an Amazon CloudWatch role for the current Account.

Required: No

Type: String

Update requires: No interruption

Return values


When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the ID of the resource, such as mysta-accou-01234b567890example.

For more information about using the Ref function, see Ref.


The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.


The ID for the account. For example: abc123.


Associate account with IAM role

The following example creates an IAM role that API Gateway can assume to push logs to CloudWatch Logs. The example associates the role with the AWS::ApiGateway::Account resource.


{ "CloudWatchRole": { "Type": "AWS::IAM::Role", "Properties": { "AssumeRolePolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "" ] }, "Action": "sts:AssumeRole" } ] }, "Path": "/", "ManagedPolicyArns": [ "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs" ] } }, "Account": { "Type": "AWS::ApiGateway::Account", "Properties": { "CloudWatchRoleArn": { "Fn::GetAtt": [ "CloudWatchRole", "Arn" ] } } } }


CloudWatchRole: Type: 'AWS::IAM::Role' Properties: AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: Service: - Action: 'sts:AssumeRole' Path: / ManagedPolicyArns: - >- arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs Account: Type: 'AWS::ApiGateway::Account' Properties: CloudWatchRoleArn: !GetAtt - CloudWatchRole - Arn

See also