<commit_before>---
title: Amazon API Gateway Tutorial - Using Multiple Roles
description: Step 4 of Amazon API Gateway Tutorial
---

# AWS API Gateway Tutorial
## Step 4 - Use Multiple Roles with Amazon API Gateway

In this step, you'll assign different AWS IAM roles to users based on authentication information:

* Users authenticating with Social Connections will be treated as buyers;
* Users authenticating with Database Connections will be treated as admins.

You will perform this role assignment logic in two different ways:

* JavaScript;
* Auth0 rules.

For many Auth0 Clients, you'll want different users to have different levels of access, and you'll want additional information about a given identity to use in your service logic. In cases where it's sufficient to lock down access at the API level, you can use different AWS IAM roles (for example, administrators can use the update function to *add* and *remove* pets, but social users can only *buy* pets).

The following diagram illustrates AWS IAM role assignments for two different user classes: users authenticated via Social Connections and users authenticated via Database Connections. It also illustrates that AWS IAM roles can be assigned to other entities, like AWS Lamdba functions, to control the permissions these entities are assigned for an account. In short, an IAM role is a group of permissions to AWS capabilities that is defined by one or more policies and then assigned to an entity.

![AWS Roles in Use](/media/articles/integrations/aws-api-gateway/roles-in-use.png)

For cases where you want to make decisions within your code (for example, you might want a credit check of a user buying a pet), you will want to flow identity as well. This will be demonstrated below in [Step 5 - Using Identity Tokens to Flow Identity](/integrations/aws-api-gateway/part-5).

### 1. Create the PetPurchase API Resource

Using the [Amazon API Gateway Console](https://console.aws.amazon.com/apigateway), select your *Pets* API. You will be taken to its *Resources* page.

![Create New Resource](/media/articles/integrations/aws-api-gateway/part-4/create-resource.png)

Click on **Actions** and **Create Resource**. Name the *New Child Resource* `Purchase`. Click **Create Resource**.

![Create Child Resource](/media/articles/integrations/aws-api-gateway/part-4/new-child-resource.png)

Add an *OPTIONS* method for the `purchase` resource as outlined previously for `pets` in the [Set Up Cors and Deploy the API section of Step 2 - Securing and Deploying the Amazon API Gateway](/integrations/aws-api-gateway/part-2#set-up-cors-and-deploy-the-api).<commit_msg>Add version warning<commit_after>---
title: Amazon API Gateway Tutorial - Using Multiple Roles
description: Step 4 of Amazon API Gateway Tutorial
---
# AWS API Gateway Tutorial

::: version-warning
Delegation is considered deprecated in Auth0. Please integrate Auth0 using custom authorizers. Use the drop-down to switch to these docs.
:::

## Step 4 - Use Multiple Roles with Amazon API Gateway

In this step, you'll assign different AWS IAM roles to users based on authentication information:

* Users authenticating with Social Connections will be treated as buyers;
* Users authenticating with Database Connections will be treated as admins.

You will perform this role assignment logic in two different ways:

* JavaScript;
* Auth0 rules.

For many Auth0 Clients, you'll want different users to have different levels of access, and you'll want additional information about a given identity to use in your service logic. In cases where it's sufficient to lock down access at the API level, you can use different AWS IAM roles (for example, administrators can use the update function to *add* and *remove* pets, but social users can only *buy* pets).

The following diagram illustrates AWS IAM role assignments for two different user classes: users authenticated via Social Connections and users authenticated via Database Connections. It also illustrates that AWS IAM roles can be assigned to other entities, like AWS Lamdba functions, to control the permissions these entities are assigned for an account. In short, an IAM role is a group of permissions to AWS capabilities that is defined by one or more policies and then assigned to an entity.

![AWS Roles in Use](/media/articles/integrations/aws-api-gateway/roles-in-use.png)

For cases where you want to make decisions within your code (for example, you might want a credit check of a user buying a pet), you will want to flow identity as well. This will be demonstrated below in [Step 5 - Using Identity Tokens to Flow Identity](/integrations/aws-api-gateway/part-5).

### 1. Create the PetPurchase API Resource

Using the [Amazon API Gateway Console](https://console.aws.amazon.com/apigateway), select your *Pets* API. You will be taken to its *Resources* page.

![Create New Resource](/media/articles/integrations/aws-api-gateway/part-4/create-resource.png)

Click on **Actions** and **Create Resource**. Name the *New Child Resource* `Purchase`. Click **Create Resource**.

![Create Child Resource](/media/articles/integrations/aws-api-gateway/part-4/new-child-resource.png)

Add an *OPTIONS* method for the `purchase` resource as outlined previously for `pets` in the [Set Up Cors and Deploy the API section of Step 2 - Securing and Deploying the Amazon API Gateway](/integrations/aws-api-gateway/part-2#set-up-cors-and-deploy-the-api).
{'fraction_non_alphanumeric': 0.06975888091293944, 'fraction_numerical': 0.004417448923246825, 'mean_word_length': 4.648648648648648, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6124896', 'n_tokens_mistral': 1420, 'n_tokens_neox': 1359, 'n_words': 734}