The expectation is no additional auth efforts are required for the client api https://docs.datomic.com/cloud/operation/access-control.html#how-datomic-access-control-works

So when the Client and Ion API Gateways have just been created they're open to the world on the execute-api URL. I've added an IAM authorizer to the API Gateway and then had to start signing my requests which we're making via an HTTP client from Google Cloud. I tried the same thing on a Client Gateway and I get a 403 while the client is attempting to retrieve the S3 auth details (judging by the stack trace). Should I not have to do that?

Have I just made things more difficult for myself by adding the IAM authorizer to the Client API Gateway and everything is secure without it?

Could you provide more details about what you are concerned about being open to the world?

I just switched ClientApi to yes in a query group. If I curl ClientApiGatewayEndpoint (taken from the CloudFormation outputs) straight after creation of the Client API Gateway I can see {:s3-auth-path "system-blahblahblah"}. If I switch on an IAM Authorizer I see {"message":"Forbidden"} via curl which makes sense since I'm not signing the request. However at this point using the Client API from the library I go from being able to get a client locally using my AWS creds in environment variables to getting a 403 (stacktrace points to datomic.client.impl.cloud$get_s3_auth_path.invokeStatic (cloud.clj:179)). My concern was that before the IAM Authorizer was switched on that root path on the Client API Gateway is open. I just wanted to confirm that we don't need the IAM Authorizer and it's fine because that first resource is publicly available but subsequent requests are using my credentials.

Since I have no idea about the other paths the client is querying I took it that that root path being open meant everything else was open. We've been using Ions via API Gateway and after upgrading to 884 had to add IAM Authorizers to those to prevent them being unauthenticated which looks like it was the default state.

As the docs say All Client API requests to Datomic Cloud use SSL, and authenticate via AWS HMAC-SHA256 signatures. so no additional auth is required for the client. The ion gateway is the part that is up to you. No decisions have been made for you there and you can configure authentication (or not) for what you build and deploy there as needed. I wrote a http://www.jarrodctaylor.com/posts/Cognito-Authentication-For-Datomic-Cloud/ post covering some ways of accomplishing that

Thanks for confirming. Maybe makes sense to post something official as an answer to that question I linked at the top if two people have independently gone down the same unnecessary path.