{
  "sourceUrl" : "https://github.com/aws-cloudformation/aws-cloudformation-resource-providers-apigateway",
  "tagging" : {
    "taggable" : false
  },
  "handlers" : {
    "read" : {
      "permissions" : [ "apigateway:GET" ]
    },
    "create" : {
      "permissions" : [ "apigateway:PATCH", "iam:GetRole", "iam:PassRole" ]
    },
    "update" : {
      "permissions" : [ "apigateway:PATCH", "iam:GetRole", "iam:PassRole" ]
    },
    "delete" : {
      "permissions" : [ "apigateway:PATCH" ]
    }
  },
  "typeName" : "AWS::ApiGateway::Account",
  "readOnlyProperties" : [ "/properties/Id" ],
  "description" : "The ``AWS::ApiGateway::Account`` resource specifies the IAM role that Amazon API Gateway uses to write API logs to Amazon CloudWatch Logs. To avoid overwriting other roles, you should only have one ``AWS::ApiGateway::Account`` resource per region per account. \n When you delete a stack containing this resource, API Gateway can still assume the provided IAM role to write API logs to CloudWatch Logs. To deny API Gateway access to write API logs to CloudWatch logs, update the permissions policies or change the IAM role to deny access.",
  "additionalProperties" : false,
  "primaryIdentifier" : [ "/properties/Id" ],
  "properties" : {
    "Id" : {
      "description" : "",
      "type" : "string"
    },
    "CloudWatchRoleArn" : {
      "description" : "",
      "type" : "string"
    }
  }
}