--- title: AWS Execute API source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/aws/aws-execute-api --- This page provides a comprehensive reference for AWS Execute API available in the workflow automation actions catalog. These actions enable you to execute any AWS API operation. ## Prerequisites Before using AWS actions in workflow automation, ensure you have: - An AWS account with appropriate permissions. - AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials). - The necessary IAM permissions for the specific AWS services you plan to use. See [Set up AWS credentials](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/) for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions. ## Security and IAM configuration To use this action, you must configure AWS credentials. See [Set up AWS credentials](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/) for detailed instructions on creating an IAM role or IAM user. > #### ⚠️ IMPORTANT > > **Security best practice:** When defining IAM policies for this action, always use least-privilege access. Grant only the specific AWS API actions your workflow requires, and restrict permissions to specific resources rather than using wildcards. ## Required IAM permissions The permissions you need depend on which AWS services and APIs your workflow calls. Use the examples below as templates for creating least-privilege policies. **Example 1: Send messages to a specific SQS queue** ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs:us-west-2::" } ] } ``` **Examples 2: Query a specific DynamoDB table** ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:Query", "Resource": "arn:aws:dynamodb:us-west-2::table/" } ] } ``` **Example 3: Multiple services with specific permissions** ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs:us-west-2::" }, { "Effect": "Allow", "Action": "dynamodb:Query", "Resource": "arn:aws:dynamodb:us-west-2::table/" } ] } ``` > #### ⚠️ IMPORTANT > > - Replace ``, ``, and `` with your actual values > - Find available AWS service APIs in the [Boto3 documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/index.html) > - For more complex IAM policy patterns, see the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) For more information on how this action works, see the [AWS Systems Manager executeAwsApi documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-executeAwsApi.html). ## Execute an AWS API [#aws-execute-api] Execute any AWS API operation for a specified service. It supports providing AWS credentials, region, service name, API name, and optional parameters. The action can return outputs such as success status, response data, and error messages, making it versatile for interacting with AWS services programmatically. ### Inputs | Input Field | Optionality | Type | Example | | ---------------------- | ----------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **awsRoleArn** | Optional | String | `arn:aws:iam::123456789012:role/my-workflow-role` | | **awsAccessKeyId** | Optional | String | `${{ :secrets: }}` | | **awsSecretAccessKey** | Optional | String | `${{ :secrets: }}` | | **awsSessionToken** | Optional | String | `${{ :secrets: }}` | | **region** | Required | String | `region: "us-east-2"` | | **service** | Required | String | `service: "sqs"`.[AWS available services](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/index.html) | | **api** | Required | String | `api: "create_queue"` | | **parameters** | Required | Map | ```yaml parameters: { "QueueName": "dks-testing-queue", "Attributes": { "DelaySeconds": "0", "MessageRetentionPeriod": "86400" } } ``` | | **selectors** | Optional | List | `[{\"name\": \"response\", \"expression\": \".response\"}, {\"name\": \"success\", \"expression\": \".success\"}, {\"name\": \"errorMessage\", \"expression\": \".errorMessage\"}]` | ### Outputs | Output Field | Type | Example | | ---------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **response** | Object | `{"response":}` - each service and api have different response, for example see the [DynamoDB Query response](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/dynamodb/client/query.html). | | **success** | Boolean | `success: true | false` | | **errorMessage** | String | `errorMessage: "User does not have permission to query DynamoDB"` | > #### ⚠️ IMPORTANT > > - Input at least one of the AWS credentials (short, long, role) should be provided, where the role takes precedence over the others. > - In the action input, if `awsAccessKeyId` and `awsSecretAccessKey` are to be provided, make sure they are static credentials of an IAM user. > - If session credentials are to be used, `awsAccessKeyId`, `awsSecretAccessKey` and `awsSessionToken` must be passed to the action input. > - Refer to [AWS credentials](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/) for instructions. > - Use selectors to get only the specified parameters as output. ### Examples #### Example: Query a DynamoDB table This example demonstrates how to query a DynamoDB table using the `aws.execute.api` action with session credentials. ```yaml name: aws_execute_api_dynamoDB_dks workflowInputs: key: type: String defaultValue: "${{ :secrets: }}" access: type: String defaultValue: "${{ :secrets: }}" region: type: String defaultValue: us-east-2 tableName: type: String defaultValue: workflow-definitions-dev scopedName: type: String version: type: String defaultValue: "1" steps: - name: executeApi type: action action: aws.execute.api version: 1 inputs: awsAccessKeyId: ${{ .workflowInputs.key }} awsSecretAccessKey: ${{ .workflowInputs.access }} awsSessionToken: ${{ .workflowInputs.token }} region: ${{ .workflowInputs.region }} service: dynamodb api: query parameters: TableName: ${{ .workflowInputs.tableName }} KeyConditionExpression: "ScopedName = :scopedNameValue AND Version = :VersionValue" ExpressionAttributeValues: ":scopedNameValue": S: ${{ .workflowInputs.scopedName }} ":VersionValue": N: ${{ .workflowInputs.version }} selectors: - name: response expression: '.response' - name: errorMessage expression: '.errorMessage' - name: success expression: '.success' - name: wait type: wait seconds: 2 - name: logOutput type: action action: newrelic.instrumentation.log version: 1 inputs: message: 'The execute API message output is:${{ .steps.executeApi.outputs.response.Item }}' licenseKey: '${{ :secrets:STAGING_NEW_RELIC_LICENSE_KEY }}' - name: logOutput1 type: action action: newrelic.instrumentation.log version: 1 inputs: message: 'does execute API have any error :${{ .steps.executeApi.outputs.errorMessage }}' licenseKey: '${{ :secrets:STAGING_NEW_RELIC_LICENSE_KEY }}' - name: logOutput2 type: action action: newrelic.instrumentation.log version: 1 inputs: message: 'is execute successful :${{ .steps.executeApi.outputs.success }}' licenseKey: '${{ :secrets:STAGING_NEW_RELIC_LICENSE_KEY }}' ``` For more workflow examples using AWS Execute API, see the [Workflow examples](https://docs.newrelic.com/docs/workflow-automation/workflow-examples/workflow-examples) page.