We have 2 internal service in a single VPC that is open to internet via
APIgateway(Regional)
Vpc link.
For green blue deployment APIGateway is only fix point for us.
Now one of the service have to talk to other service, and we do that via hitting APIgateway, and because the other service is within a VPC we have to use proxy to connect to that APIgateway(Regional). But we still need a Regional APIgateway as we have other service outside the VPC.
Service A -> Proxy -> Regional API Gateway of Service B
Now the question is can we have a Private APIgateway also Regional APIgateway working in parallel and hit the same ECS service?
In this case we will not have to go via proxy at all.
A VPCLink can be reused across numerous API Gateway endpoints, this will work as long as the API Gateway and Network Load Balancer are within the same account.
The Network Load Balancer and API must be owned by the same AWS account.
Related
I'm trying to expose an HTTP server to the internet. The server runs on a Fargate container inside a dedicated VPC. I could just expose it through a public Application Load Balancer (ALB) if it wasn't for the fact that requests to this server must be authenticated using IAM.
My approach was to put an AWS Gateway v1 in front of the service's load balancer. This Gateway verifies authentication through IAM, then relays the request to a Network Load Balancer (NLB) using a VPC Link. The NLB in turn routes it to the server itself.
Here's the problem: Api Gateway v1 does not support VPC Links to ALBs, only NLBs, but NLBs use TCP, while I'm exposing an HTTP server. This way I can't relay paths and other HTTP features through the Network Load Balancer.
Api Gateway v2 does support VPC Links to ALBs, but it does not have a way to authenticate using IAM.
Is there any way to work around this problem?
I am not sure why you think api gtw 2 does not allow IAM authentication or where you got that from?
Can you put your cloudformation here or point to a git so I can test it with a policy?
Can you put the link where it says that API GTW 2 does not suport IAM Authorization?
The documentation clearly mentions that you can use IAM Authorisers?
https://docs.aws.amazon.com/apigatewayv2/latest/api-reference/doc-history.html
Here is a blog that might help?
https://aws.amazon.com/premiumsupport/knowledge-center/iam-authentication-api-gateway/
You could go the long way and use Cognito Pool, link that to you API GTW, if what you say is true.
https://aws.amazon.com/blogs/security/building-fine-grained-authorization-using-amazon-cognito-api-gateway-and-iam/
hope this helps, I'd be curious of your Cloud Formation if you are willing to share.
I am trying to understand the use of API Gateway along with AWS ALB (Ingress Controller) for the EKS cluster.
Let's say,
there are 10 microservices in the AWS EKS cluster running on 10 pods. The EKS cluster is in Private VPC.
I can create Kubernetes Ingress which will create an ALB and provide rule-based routing. The ALB will be in Public VPC and I believe, AWS will allocate a public ip to the ALB. I can configure the ALB behind Route53 to access using the domain name. My understanding says that ALB supports multiple features including host or path based routing, TLS (Transport Layer Security) termination, WebSockets, HTTP/2, AWS WAF (Web Application Firewall) integration, integrated access logs, and health checks.
So, security wise there should not be any challenge. Am I wrong?
Please refer Link of the above mentioned solution architecture.
Is there any specific use case where I need to use AWS API Gateway in front of AWS ALB in the above-mentioned architecture?
What are additional benefits the AWS API Gateway has along with AWS ALB?
Should I put AWS ALB in the Private VPC if decided to use AWS API Gateway in front of that?
With API GW you will get rate limiting, throttling and if you want to authenticate and authorize requests based on OAUTH or any other auth model that can be done with API GW.
I have a problem configuring my AWS API Gateway:
I have an API deployed in an EKS cluster, and it has a public load balancer, so right now, this API is accessible from everywhere. I want to allow access to this API only from AWS API Gateway, so if anyone wants to use the API, it has to be through AWS API Gateway.
The problem is that I don't know how to allow traffic to the API only from API Gateway. I tried using a security group, but AWS API Gateway IP changes all the time. I tried also using an internal load balancer in my Kubernetes deployment, but AWS API Gateway can't reach that loadbalancer!
Thanks in advance with the help!
You can do this by using a Network Load Balancer.
Create an internal network load balancer and have your containers be added to its target group.
Then in API Gateway create a VPCLink to your Network Load Balancer. Then use the VPCLink within your API Gateway setup.
More instructions available here.
You might be able to accomplish this by setting up an API Gateway private integration. This makes it simple to expose your HTTP/HTTPS resources behind an Amazon VPC for access by clients outside of the VPC.
Also, have a look at Amazon EKS cluster endpoint access control in order to understand how you can enable endpoint private access for your cluster.
I have 1 Lambda Function connected to AWS Oracle RDS. I have exposed lambda to outer world via API Gateway.
How can i access same API Gateway in my EC2 Instance where i have my back-end services running?
[ec2-user#ip-22-22-22-22 dummy]$ ./telnet 10apexecute2.execute-api.eu-west-1.amazonaws.com 443
Trying 55.11.144.98...
Please help
As the account must be restrictive with its outbound communication over internet, the suggested solution would to make use of a VPC endpoint for API Gateway.
Once you create this endpoint, make sure to enable the "Enable Private DNS Name" option to override the DNS resolution for execute-api endpoints to speak to resolve through your VPC endpoint.
More information can be found in this blog post: Introducing Amazon API Gateway Private Endpoints | AWS Compute Blog
I have a situation to use AWS private(internal-facing) application load balancer (not a network load balancer) in the api gateway. Can anyone please guide me how to use ALB in the api gateway.
It is possible to integrate API Gateway with a private or internal facing ALB using http api route with private resource integration through a VPC link.
I've done so with an API Gateway --> VPC link --> internal facing ALB --> EC2 cluster with fargate in private subnets
See https://stackoverflow.com/a/67413951/2948212 for a step by step guide.