Repository navigation
Feature request: Support for 'SecurityPolicy' property to 'AWS::Serverless::Api' #8519
Description
Describe the feature
Currently, while creating the resource 'AWS::Serverless::Api'[1], there is no property to set a Security policy. Instead, we have a sub-property under 'DomainConfiguration' that creates a separate resource 'AWS::ApiGateway::DomainName'[2]. That said, we could directly add a new 'SecurityPolicy' property under 'AWS::Serverless::Api', which would apply the Security policy similar to console/API usage for the REST API resource 'AWS::ApiGateway::RestApi'.
[1] https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-api.html
[2] https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-api.html#sam-api-domain
Replication:
Since this property doesn't exist, we will get the following expected error with 'sam build':
Error: [InvalidResourceException('property SecurityPolicy not defined for resource of type AWS::Serverless::Api')]
Workarounds:
- Import the resource 'AWS::ApiGateway::RestApi' into the stack.
- Create the REST API resource 'AWS::ApiGateway::RestApi' directly in the SAM template to use the 'SecurityPolicy' property.
Proposed Solution:
Add a new property 'SecurityPolicy' to resource 'AWS::Serverless::Api' which will add the Security policy similar to console/API usage to the REST API resource directly 'AWS::ApiGateway::RestApi'.
Activity
ryanwdale commentedon Jan 7, 2026
I'm also affected by this issue
Adding the documentation for the corresponding fields on the
AWS::ApiGateway::RestApiCFN resource:bnusunny commentedon Jan 26, 2026
This needs to be added in SAM Translator first. Here is the PR for that.
roger-zhangg commentedon Jul 2, 2026
Closing — this feature has been implemented and shipped.
The SAM Transform PR aws/serverless-application-model#3872 added
SecurityPolicysupport toAWS::Serverless::Apiand was merged on 2026-01-27. SAM CLI has since picked up the updated translator (1.111.0 as of today).If you're on the latest SAM CLI version, you can now use
SecurityPolicydirectly on yourAWS::Serverless::Apiresource. Thanks for the feature request!github-actions commentedon Jul 2, 2026
Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.