I have a slack bot which is running on a EC2 in a VPC.
The VPC/ API gateway is supposed to only be exposed to slack (for slack event listening), Its not supposed to be publicly accessible.
How would I filter based on slack's DNS? https://api.slack.com/robots
I saw that API gateway has resource policies however they are only IP\ AWS account\ VPC based.
Any other AWS services that can help?
If the only reason you're exposing it to the web is for Slack to access it, then you could try using Socket Mode, which pushes all the Slack traffic to websockets, meaning you don't need a public endpoint anymore.
Related
Using AWS Direct Connect, we've built a network between our on-premise and our AWS VPC. We've developed a web application that users will access from within the on-prem network. We're using the HTTP API Gateway, which uses a VPC Link to connect to the private ALB. We've used a Custom Domain Name with the HTTP API Gateway and disabled the default endpoint. The domain name is registered in a private hosted zone on Route 53.
We want to keep all the traffic between the clients and the API Gateway within our private network. However, we can see that the requests going to the HTTP API Gateway leave our network because the custom domain name for the API Gateway resolves to a public IP address.
Is there a way to assign a private IP address to the HTTP API Gateway? Or any other way to keep the traffic within our network?
One option is to switch to the REST API Gateway and make its endpoint type Private. However, the HTTP API Gateway suits our needs much better with its simplicity. It also has the option for connectivity to an ALB using VPC Link, which the REST Gateway lacks.
Sadly no, the HTTP APIs do not support Private APIs. Whatever solution you will use, HTTP API endpoint must be public.
You have to use REST API, or create your own fully custom solution if REST API is out of question.
I want to provide an update to this topic.
AWS updated its product and private endpoints are available right now.
AWS - Private API endpoint
There are also a couple of examples out there also for CDK, Cloudformation or management console.
I hope this helps
I have a problem configuring my AWS API Gateway:
I have an API deployed in an EKS cluster, and it has a public load balancer, so right now, this API is accessible from everywhere. I want to allow access to this API only from AWS API Gateway, so if anyone wants to use the API, it has to be through AWS API Gateway.
The problem is that I don't know how to allow traffic to the API only from API Gateway. I tried using a security group, but AWS API Gateway IP changes all the time. I tried also using an internal load balancer in my Kubernetes deployment, but AWS API Gateway can't reach that loadbalancer!
Thanks in advance with the help!
You can do this by using a Network Load Balancer.
Create an internal network load balancer and have your containers be added to its target group.
Then in API Gateway create a VPCLink to your Network Load Balancer. Then use the VPCLink within your API Gateway setup.
More instructions available here.
You might be able to accomplish this by setting up an API Gateway private integration. This makes it simple to expose your HTTP/HTTPS resources behind an Amazon VPC for access by clients outside of the VPC.
Also, have a look at Amazon EKS cluster endpoint access control in order to understand how you can enable endpoint private access for your cluster.
I have 1 Lambda Function connected to AWS Oracle RDS. I have exposed lambda to outer world via API Gateway.
How can i access same API Gateway in my EC2 Instance where i have my back-end services running?
[ec2-user#ip-22-22-22-22 dummy]$ ./telnet 10apexecute2.execute-api.eu-west-1.amazonaws.com 443
Trying 55.11.144.98...
Please help
As the account must be restrictive with its outbound communication over internet, the suggested solution would to make use of a VPC endpoint for API Gateway.
Once you create this endpoint, make sure to enable the "Enable Private DNS Name" option to override the DNS resolution for execute-api endpoints to speak to resolve through your VPC endpoint.
More information can be found in this blog post: Introducing Amazon API Gateway Private Endpoints | AWS Compute Blog
I'm looking to setup an AWS API Gateway which will have private APIs (internal business client apps only)
One of the client apps that will be making requests to 1 of the apis is a client that is on-prem.
What options are available to authenticate requests coming from a client when that client is on-prem? Is there some type of tunnel I am able to create between the on-prem client on AWS VPC?
I dont want to at all make the APIs public. So I want to continue to keep all apis private. Any and all insights appreciated.
The following tools are provided to enhance the security of API Gateway.
Firstly there's support for a private API Gateway. By doing this it will only be accessible from the VPC and devices connected via VPN or Direct Connect to the API Gateway.
If it must be publicly accessible, but kept private you can lockdown he endpoint via either an API Gateway Resource Policy or by attaching a WAF to your API Gateway.
Finally if you need more advanced methods of authenticating and providing authorization to specific routes in your API, then you should look at API Gateways feature of Lambda Authorizers.
It looks like the simple answer is:
Option 1: Use Direct Connect
https://docs.aws.amazon.com/directconnect/latest/UserGuide/Welcome.html
or
Option 2: Use AWS Site-to-Site VPN
https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html
I have a situation when my product(some Web API) is living inside of VPC, i.e. with no any any external access. I'd like to expose the part of this APIs(just a couple of HTTP methods) to be accessible from the internet. I'm trying to achieve this using AWS API Gateway but it looks like I cannot make internal ELB endpoint the API Gateway resource. Any ideas how can I do this?
Thanks,
--Vovan
This was originally not possible, and then was solved with support for client certificates that API Gateway could use to authenticate itself to your services. This was a good solution, and is still available, but still required your services to be exposed -- at least in some sense -- to the Internet.
In November, 2017, AWS released a new capability that allows you to actually provision a network path between API Gateway and your internal services.
You can now provide access to HTTP(S) resources within your Amazon Virtual Private Cloud (VPC) without exposing them directly to the public Internet. You can use API Gateway to create an API endpoint that is integrated with your VPC. You create an endpoint to your VPC by setting up a VPC link between your VPC and a Network Load Balancer (NLB), which is provided by Elastic Load Balancing.
https://aws.amazon.com/about-aws/whats-new/2017/11/amazon-api-gateway-supports-endpoint-integrations-with-private-vpcs/
Historical context follows.
As of now, there is no simple and foolproof way to do this, because your services that are accessible to API Gateway need to be accessible via/exposed to the public Internet and there is no built in trust mechanism by which you can be assured that such a request actually originated from any API Gateway deployment, much less your API Gateway deployment.
Amazon seems to have solved the issue of authenticating requests to your back-end services as having assuredly come, not only from API Gateway, but from your API Gateway instance. As before, endpoints still need to be exposed to the Internet, since the source IP address is not predictable -- but API gateway now supports client SSL certificates, which the back-side of API Gateway uses to authenticate itself to the front-side of your back-end service, that API gateway is calling.
Q: Can Amazon API Gateway work within an Amazon VPC?
No. Amazon API Gateway endpoints are always public to the Internet. Proxy requests to backend operations also need to be publicly accessible on the Internet. However, you can generate a client-side SSL certificate in Amazon API Gateway to verify that requests to your backend systems were sent by API Gateway using the public key of the certificate.
Q: Can I verify that it is API Gateway calling my backend?
Yes. Amazon API Gateway can generate a client-side SSL certificate and make the public key of that certificate available to you. Calls to your backend can be made with the generated certificate, and you can verify calls originating from Amazon API Gateway using the public key of the certificate.
— https://aws.amazon.com/api-gateway/faqs/#security
When you generate a client certificate in the API Gateway console, you're provided with the public key for that certificate. For security, the private key is retained by API Gateway and is not accessible to you. API Gateway will present the public key to your back-end when negotiating SSL. Any peer not presenting that same public key is not API gateway, and your back-end should deny SSL negotiation.
If a malicious actor should ever come into possession of the public key, they would not still be able to communicate with your back-end over SSL, because they would lack the mated private key, which is only known to API Gateway. (Your side of the interaction would be encrypted using your SSL certificate and it's mated private key, which is of course, known only to you.)
This capability addresses what previously appeared to be a significant limitation of the utility of API Gateway's HTTP proxy functionality... a limitation of such significance, in fact, that when I discovered the revised information, above, I began to doubt myself: Had this been there all along, and I had somehow managed to overlook it? The Wayback Machine says no, it's new. This information was added in September, 2015.
It's somewhat of a circuitous path, but you can proxy your Web service endpoints that are in a VPC through a Lambda function. That Lambda function can be called directly from the API Gateway. This blog post gives details on how to do that.