Unable to Connect API Gateway to Internal Network Load Balancer in VPC

Question

I have set up a network load balancer (NLB) in a VPC, which is associated only with private subnets. This NLB is internal and is not internet-facing. My goal is to connect from the API Gateway to this NLB. I found a workaround where changing the security group to allow all traffic (0.0.0.0/0) enables the connection, but this approach is not secure and not what I am aiming for.

Is there an appropriate method to securely connect the API Gateway to an internal NLB in a VPC? Could using a VPC endpoint be the solution to this problem?

Accepted Answer

As your using a REST API, then I believe the only option would to be allow the VPC CIDR Range eg, 172.31.0.0/16 in your security group instead of 0.0.0.0/0

**UPDATED**

You can also DISABLE Enforce inbound rules on PrivateLink traffic via the GUI on the NLB or CLI. This means private link traffic can still connect to the NLB if you dont allow any other traffic!

https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html

Search for **Enforce inbound rules on PrivateLink traffic.** ^^

Answer

But I am Using Rest API

Answer

If using VPC Link for HTTP APIs then,

When you create your API Gateway VPC Link, you can define which security group to attach to the connection. This creates ENI's in your VPC with the SG attached.

Then, use this Security group ID as the source on your NLB security group. This will allow access from the APi Gateway security group and not a CIDR Range

Answer

Thank You for your Prompt Response , I tried to give my VPC CIDR Range eg, 172.31.0.0/16 in My security group instead of 0.0.0.0/0 , then still it didnt Worked.!
and if i do the second approach is it secure?

Unable to Connect API Gateway to Internal Network Load Balancer in VPC

Relevanter Inhalt