Proper way to connect Private API Gateway to VPC in SAM (AWS IAC)

user_12982159 0
Viewed 1567

I am trying to connect an AWS Private API Gateway to my VPC through a VPC Endpoint that already exists in my deployment stack, but when I check in the console I don't see a connection.

Below is some code snippets from my YML file.

I have pulled the VPC endpoint from SSM and have confirmed that this is the Endpoint ID. My VPE Endpoint ID comes up as vpce-XXXXXXXXXXXX in SSM under "APIGW"

Parameters:
  TenantName:
    Type: String
  Profile:
    Type: String

  ...

  # VPC params for API GW
  VPC:
    Type: String
  APIGW:
    Type: String

I then make my Private API Gateway as follows. It contains one Lambda defined above this API.

  PrivateApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: PrivateApi
      StageName: v1
      MethodSettings:
        - HttpMethod: '*'
          ResourcePath: /*/*/*
          LoggingLevel: ERROR
          ThrottlingBurstLimit: 5000
          ThrottlingRateLimit: 10000
      EndpointConfiguration: PRIVATE
      DefinitionBody:
        swagger: 2.0
        info:
          title: PrivateApi
        x-amazon-apigateway-api-key-source: "HEADER"
        schemes:
          - https
        x-amazon-apigateway-policy:
          Version: "2012-10-17"
          Statement:
            -
              Effect: "Allow"
              Principal: "*"
              Action:
                - "execute-api:Invoke"
              Resource: "execute-api:/*"


              Condition:
                StringEquals:
                  aws:sourceVpce: !Ref APIGW 


        paths:
          /{proxy+}:
            x-amazon-apigateway-any-method:
              produces:
              - application/json
              parameters:
              - name: proxy
                in: path
                required: true
                type: string
              x-amazon-apigateway-integration:
                uri:
                  Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${HandleSecurityRouter.Arn}/invocations
                httpMethod: POST
                type: aws_proxy

But if I look in the console after a successful deployment using the SAM tool, the API Gateway is not connected to any VPC endpoints.

Any help in getting this VPC endpoint to connect to my Private API Gateway with SAM would be much appreciated!

serverless amazon-web-services yaml
2 Answers

After making a version of what I needed in the console and turning it back into YML with the AWS "Export as Swagger" feature under "API"->Stages->"Stage"->Export, I found an undocumented or hard to find property of API Gateway swagger that needs to be added to link a Private Gateway to a VPC through a VPC endpoint.

What is needed is the following lines in your swagger:

      DefinitionBody:
        swagger: 2.0
        ...
        x-amazon-apigateway-endpoint-configuration:
          vpcEndpointIds:
            - !Ref API-Gateway-ID
user_129821590

It worked for me adding the line below servers -> url -> x-amazon-apigateway-endpoint-configuration:

openapi: "3.0.2"
info:
  title: "APIGW-TEST-01"
  version: "1.0"
servers:
- url: "https://asdf.execute-api.us-east-1.amazonaws.com/{basePath}"
  variables:
    basePath:
      default: "/test"
  x-amazon-apigateway-endpoint-configuration:
    vpcEndpointIds:
    - "vpce-0asdf"
paths:  
...
user_88272160
Related