I'm new to the GCP Services, and I'm trying to make an API Gateway to proxy two services, one is run on an App Engine and the other is actually a PaaS.
Can I configure Cloud Endpoints to redirect to that PaaS, and how? and if now what service in GCP suits this case?
Edit:
An example of what I'm trying to do is if my domain is test.com then i'd like app.test.com to be redirected to my App Engine and ip.test.com would be directed for example to https://httpbin.org/ip.
I wrote an article on this for securing the endpoint. Set the value that you want in the x-google-backend.
I also provide some tips about the URL rewriting if you want.
EDIT 1
If you want to perform this routing
app.test.com -> App Engine
ip.test.com -> External service
You need to use a HTTPS Load Balancer and not API Gateway.
Then,
create a serverless NEG and configure it with App Engine
create an Internet NEG and configure it to reach your internet accessible PaaS service
Create a URL MAP with the correct routing
That's all (wait 3 - 5 minutes, the delay to dispatch your configuration around the globe.)
Yes, you can run an Extensible Service Proxy in front of your non-GCP backend service so that Cloud Endpoints can proxy requests to it.
Docs: https://cloud.google.com/endpoints/docs/openapi/running-esp-localdev
Related
I'm trying to set up my testing environment on AWS.
I don't want to use the public domain, but only the custom domain that is setup on VPN.
Basic case:
Backend node.js API service and static frontend app in react.
I created a service with a task for the backend and deployed a static page on S3 bucked.
Is any option to set up it together using ALB and targets group?
Or maybe another solution is how to handle a case like that.
The main condition is that I don't want to use the public domain and Route 53.
If is any other option then S3 is not a crucial solution.
I will be grateful for any suggestion or example for a similar stack.
I'm running a backend app with several endpoints on Cloud Run(fully-managed). My endpoints are publicly available by its nature so I don't want to authenticate users through my client app hosted on Netlify.
What I do need is to restrict access to my endpoints so that other applications or malicious users can't abuse it. It is not about scaling, I just don't want to exceed the Free Tier limits since it is a demo of an opensource application.
I've already set the concurrency and max instance limits to minimum but this alone is not enough. There is also a product named Google Cloud Armor but it seems an expensive one, not free.
I was expecting to have a simple built-in solution for this but couldn't find it.
What other solutions do I have? How can I block the traffic coming out of my website on Netlify?
You don't have a lot of solution:
You don't want to authenticate your users -> so you need to rely on the technical layers
Netlify is a serverless hosting platform, you don't manage servers/IPs -> So you need to rely on the host name
To filter on the host name, you can use 2 products
External HTTPS only (about $15 per month) with url path matching.
Default URL land on a dummy service
Only request where the host matches your netlify host name are redirected to your backend
Use Cloud Armor on top of External HTTPS load balancer ($15 + Cloud Armor policy x traffic volume). The time, the load balancer redirect the default URL to the correct backend and Cloud Armor check the request origin.
The problem is that this weak solution is easy to overpass. Perform a simple curl with the host as header, and HTTPS Load Balancer and Cloud Armor think that is the correct origin
curl -H 'Host: myNetlifyHost.com' ....
The highest protection is the authentication. Google Cloud itself say: "Don't trust the network".
I have a backend service, which I don't want to be expose, and also, just the employees that uses Gsuite oAuth should access.
Instead of exposing the backend and add the logic of oauth in it, I looked at the vouch-proxy project, which fits me very well (a proxy that redirects unauthenticated traffic to oauth login page and then, when a valid token is passed, it's redirect to the backend.
Before using this vouch proxy, do GCP has something built-in for it? Or another kind of setup that my backend service is not exposed?
Google Cloud provides the Identity-Aware Proxy (IAP) that would precisely fit your needs since it's integrating well with G Suite domain and can sit in front of your Load-Balancer.
How to integrate API gateway with application load balancer? I have integrated ECS with ALB, now I want to add API gateway in front without lambda. But I got confused how to connect API gateway with ALB..
What you're probably looking for is the HTTP Proxy Integration as described here
The basic idea is this:
Set up your API-Gateway with a greedy path like /{proxy+} on the ANY Method
Set the backend-endpoint to https://my-alb-endpoint.com/ecs-service-bla/{proxy}
(hopefully) success
To make this work, your backend needs to be exposed to the internet (or at least reachable for the API Gateway)!
You probably should keep your backend within a locked down VPC, but for this you're going to need to set up a private integration, which requires a Network Load balancer - this might be costlier, but would be the recommended approach.
Yes you can do . Inside API Gateway under integration type select HTTP and then provide complete path of ALB with endpoint resource.
I have a spring boot rest project which is running successfully, and I am getting success response on http://localhost:8080/students. How can I expose this SpringBoot REST API into a private AWS API GATEWAY? I have to expose the REST API service, and I have to give the endpoints to the client, to access this service. I have no idea how to present and create endpoints in AWS API GATEWAY!
API Gateway will work as mediator between clients and your application. So in the first place your application should be exposed so AWS Gateway could make a call to it.
If you are running application on your local pc you need to expose it to Internet by setting static IP and openning corresponding ports in firewall if you have one. This may works for debug/testing purpose, but in general it is bad because you will expose your application to Internet and client services would have possibility to connect to it directly, instead of gateway.
Other and more proper on my opinion would be to run your application in AWS EC2 instance or in AWS beanstalk. In this case you can configure private endpoint for your application and make it available only through API Gateway. Here you can find more details https://aws.amazon.com/blogs/compute/introducing-amazon-api-gateway-private-endpoints/
So let's suppose you have your application up and running and available for API Gateway. In this case you will need to perform :
Create API in API Gateway
Create resources, i.e. path /user would be user resource
For each resource create a method, i.e. GET, POST, etc. Select integration type HTTP for your methods and set the endpoint it will use
Deploy API to staging