Learn how to securely access AWS API Gateway from EC2 instances within a private VPC, preventing public exposure and data leakage using interface VPC endpoints and resource policies.
Table of Contents
Question
A company is running an application in the AWS Cloud. The application consists of microservices that run on a fleet of Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer. The company recently added a new REST API that was implemented in Amazon API Gateway. Some of the older microservices that run on EC2 instances need to call this new API.
The company does not want the API to be accessible from the public internet and does not want proprietary data to traverse the public internet.
What should a solutions architect do to meet these requirements?
A. Create an AWS Site-to-Site VPN connection between the VPC and the API Gateway. Use API Gateway to generate a unique API Key for each microservice. Configure the API methods to require the key.
B. Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private.
C. Modify the API Gateway to use IAM authentication. Update the IAM policy for the IAM role that is assigned to the EC2 instances to allow access to the API Gateway. Move the API Gateway into a new VPDeploy a transit gateway and connect the VPCs.
D. Create an accelerator in AWS Global Accelerator, and connect the accelerator to the API Gateway. Update the route table for all VPC subnets with a route to the created Global Accelerator endpoint IP address. Add an API key for each service to use for authentication.
Answer
B. Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API. Add a resource policy to API Gateway to only allow access from the VPC endpoint. Change the API Gateway endpoint type to private.
Explanation
To meet the requirements of not exposing the API to the public internet and preventing proprietary data from traversing the public internet, the solution involves creating an interface VPC endpoint for API Gateway. This establishes a private connection between the VPC and API Gateway, allowing the microservices running on EC2 instances to securely access the API without going through the public internet.
The steps to implement this solution are:
- Create an interface VPC endpoint for API Gateway in the same VPC as the EC2 instances.
- Set an endpoint policy on the VPC endpoint to allow access only to the specific API or API resources required by the microservices.
- Add a resource policy to the API Gateway to restrict access from only the VPC endpoint.
- Change the API Gateway endpoint type from edge-optimized to private, ensuring it is not accessible from the public internet.
By following these steps, the microservices can securely access the API through the private VPC endpoint, without exposing the API to the public internet or allowing proprietary data to traverse the public network.
Amazon AWS Certified Solutions Architect – Professional SAP-C02 certification exam practice question and answer (Q&A) dump with detail explanation and reference available free, helpful to pass the Amazon AWS Certified Solutions Architect – Professional SAP-C02 exam and earn Amazon AWS Certified Solutions Architect – Professional SAP-C02 certification.