aws-cdk - Private API Gateway using SpecRestApi (openAPI 3)

Resolved

The following PR fixes the issue:

https://github.com/aws/aws-cdk/pull/9068 Fixes this issue. You can now set your endpointType like this:

const api = new apigateway.SpecRestApi(this, 'ExampleRestApi', {
  apiDefinition: apigateway.ApiDefinition.fromInline(replacedSwagger),
  endpointTypes: [apigateway.EndpointType.PRIVATE],
});

Note: For private endpoints you will still need to provide the x-amazon-apigateway-policy in your openApi file.

Original question

I am trying to use aws-cdk to configure a Private API Gateway using the SpecRestApi. (openApi 3).

By default, it creates an endpoint with an EDGE configuration.

The documentation indicates I should be using the x-amazon-apigateway-endpoint-configuration object inside the servers section, but when using it, it does seem to be ignored by API Gateway.

The API part code doesn't have much of a magic.

    const api = new SpecRestApi(this, 'ExampleRestApi', {
      apiDefinition: ApiDefinition.fromInline(replacedSwagger),
      restApiName: `myTest`,
      deploy: false
    });

An example swagger can be found here:

{
    "openapi": "3.0.1",
    "info": {
        "title": "ismael-test",
        "description": "ismael-test Rest API",
        "version": "1.0.1"
    },
    "servers" : [
        "x-amazon-apigateway-endpoint-configuration": {
            "vpcEndpointIds": [
                "vpce-00111a1111a1aa011"
            ]
        }
    ],
    "paths": {
        "/example": {
            "get": {
                "responses": {
                    "200": {
                        "description": "200 response",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/SampleResponse"
                                }
                            }
                        }
                    }
                },
                "x-amazon-apigateway-integration": {
                    "uri": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:${AWS::Region}:${AWS::AccountId}::function:ismael-test-st-imr:st-imr/invocations",
                    "responses": {
                        "default": {
                            "statusCode": "200"
                        }
                    },
                    "passthroughBehavior": "when_no_match",
                    "httpMethod": "POST",
                    "contentHandling": "CONVERT_TO_TEXT",
                    "type": "aws_proxy"
                }
            }
        }
    },
    "components": {
        "schemas": {
            "SampleResponse": {
                "title": "Sample Response",
                "type": "object",
                "properties": {
                    "message": {
                        "type": "string"
                    }
                }
            },
            "500Response": {
                "$ref": "#/components/schemas/Error"
            },
            "Error": {
                "type": "object",
                "properties": {
                    "errorCode": {
                        "type": "string"
                    },
                    "message": {
                        "type": "string"
                    }
                }
            }
        }
    },
    "x-amazon-apigateway-policy": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": "*",
                "Action": [
                    "execute-api:Invoke",
                    "execute-api:GET"
                ],
                "Resource": "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:*",
                "Condition": {
                    "StringEquals": {
                      "aws:sourceVpce": "vpce-00111a1111a1aa011"
                    }
                }
            }
        ]
    }
}

If using the servers/x-amazon-apigateway-endpoint-configuration section, the deployment fails with the following message:

AmazonApiGateway; Status Code: 400; Error Code: BadRequestException;
Request ID: 12600381-6232-4213-894d-264b7501828b) ```

Thanks in advance!

Note that the vpce id have been modified just in case.