How can I invoke an API Gateway private API using an Application or Network Load balancer?
I want to set up my API Gateway private API as a target behind a load balancer. Then, I want to access my private API from an Application or Network Load Balancer using my account or another AWS account. How do I set this up?
Short description
To access your private API using AWS Direct Connect or Amazon Route 53, see How to invoke a private API. You can also access an API Gateway private REST API in another AWS account using an interface VPC endpoint.
In the following set up, the private API is added as a target to the load balancer. This is done using the Amazon Virtual Private Cloud (Amazon VPC) endpoint elastic network interface IP address.
Important:
Custom domain names are not supported for private APIs. As a workaround, you can invoke and attach the domain to a load balancer. Then, invoke the private API using the setup described in this article.
Resolution
Create an Amazon VPC endpoint
1. Open the Amazon VPC console, choose
Endpoints
, and then choose
Create endpoint
.
Note:
If you have any Amazon VPC endpoints already set up in your VPC using the API execute-api, then make sure that private DNS is disabled.
2. For
Services
, choose
com.amazonaws.com.your-region.execute-api
.
3. For
VPC
, choose your Amazon VPC.
4. For
Subnets
, choose two subnets in different Availability Zones (AZ IDs), and then choose
Create endpoint
.
5. Choose your endpoint, choose
subnets
, and copy the
IP address
. You use this IP address in another step.
For more information, see Create an interface VPC endpoint for API Gateway execute-api.
Create a private REST API and grant the Amazon VPC endpoint permission
1. Open the API Gateway console, and then choose
Create API
.
2. For
REST API
, choose
Build
.
3. In
Settings
, enter the following:
For
API name
, enter a name for the API.
For
Endpoint Type
, choose
Private
.
For
Endpoint IDs
, enter and the endpoint ID that you created previously.
4. Choose
Create API
.
5. In the navigation pane, choose
Resource Policy
.
6. In the resource policy editor, paste the following policy:
Note:
Replace
vpce-<id>
with your VPC endpoint ID.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "execute-api:Invoke",
"Resource": "arn:aws:execute-api:<region>:<account :<api-id>/*/*/*",
"Condition": {
"StringNotEquals": {
"aws:sourceVpce": "vpce-081234d1ad408e"
}
}
},
{
"Effect": "Allow",
"Principal": "*",
"Action": "execute-api:Invoke",
"Resource": "arn:aws:execute-api:<region>:<account-id>:<api-id>/*/*/*"
}
]
}
7. Choose
Save
.
For more information, see Create a private API using the API Gateway console.
Create or import an AWS Certificate Manager public certificate
If you haven't already done so, do one of the following:
Request a public certificate.
-or-
Import a certificate
Create an Application Load Balancer or a Network Load Balancer
If you haven't already done so, do one of the following:
Create an Application Load Balancer
-or-
Create a Network Load Balancer
Create the target group
1. Open the Amazon Elastic Compute Cloud (Amazon EC2) console.
2. In the navigation pane, in
Load Balancing
, choose
Load Balancers
, choose
Target Groups
, and then choose
Create target group
.
3. For
target type
, choose
IP addresses
.
4. for
Target group name
, enter a name.
Application Load Balancer
For
Protocol
, choose
HTTPS
.
For
Port
, choose
443
.
For
VPC
, choose your VPC.
For Health check path, enter 200,403. (This makes sure that the VPC endpoint shows as
Healthy
in the target group)
Network Load Balancer
For
Protocol
, choose
TLS
.
For
Port
, choose
443
.
For
VPC
, choose your VPC.
5. Choose
Next
.
6. In
Specify IPs
, enter the IP address that you copied in the
Create an interface Amazon VPC endpoint
section, and choose
Add IPv4 address
.
7. Choose
Create target group
.
Configure the load balancer
1. Open the EC2 console.
2. In the navigation pane, choose
Load Balancers
, and then choose
Create Load Balancer
.
Application Load Balancer
For
Scheme
, choose either
Internet-facing
or Internal depending on your configuration.
For
Protocol
, choose
HTTPS
.
For
VPC
and
subnets
, choose your VPC and subnets.
Network Load Balancer
For
Scheme
, choose either
Internet-facing
or Internal depending on your configuration.
For
Protocol
, choose
TLS
.
For
VPC
and
subnets
, choose your VPC and subnets.
For
Security policy
, choose the default policy
ELBSecurityPolicy-TLS (recommended)
.
For
Default SSL/TLS certificate
, choose
From ACM
.
Choose the
Select a certificate
dropdown menu, and then choose your certificate.
3. Choose
Create load balancer
.
Note:
The load balancer targets should be the IP addresses of the elastic network interface that the VPC endpoint created. These were done in step 1. You can find those elastic network interfaces by selecting your VPC endpoint and opening the Subnets tab.
Create a record in an Amazon Route 53 public or private hosted zone
If you haven't already done so, do one of the following:
Create a public hosted zone
-or-
Create a private hosted zone
Then, create a CNAME record and associate it with your Application or Network Load Balancer.
Testing
For public load balancers, you can make a curl request from your local machine.
For private load balancers, launch a new EC2 instance in one of the subnets for your load balancer. Then, make a curl request similar to the following:
curl -v https://{custom-domain-name}/<stage-name>/<resource-path> -H 'Host: <api-id>.execute-api.<region>.amazonaws.com'
curl -v https://{custom-domain-name}/<stage-name>/<resource-path> -H 'x-apigw-api-id:{api-id}'
A successful request returns a
200 OK
response code. An unsuccessful request returns a
403 Forbidden
response code or a DNS resolution error. If you encounter any issues, see Troubleshoot your load balancers.
How do I connect to a private API Gateway over a Direct Connect connection?
How do I troubleshoot issues when connecting to an API Gateway private API endpoint?
Setting up CloudWatch logging for a REST API in API Gateway
Monitoring REST APIs with Amazon CloudWatch metrics
Submit feedback
Do you need billing or technical support?
Contact AWS Support