How do I access private API Gateway endpoints from my VPC and maintain connectivity to my public APIs?

Short description

API Gateway private REST APIs can be accessed from Amazon VPC interface endpoints. However, you might not successfully connect to private and public APIs at the same time depending on if private DNS is turned on or off.

Resolution

Create a VPC interface endpoint for API Gateway

Complete the following steps:

1. Open the VPC console.
2. Choose Endpoints, and then choose Create endpoint.
3. For Type, choose AWS Services.
4. In the Services search bar, enter execute-api.
5. For Service Name, choose com.amazonaws.region.execute-api.
6. Choose the VPC dropdown list, and then select the VPC that you want to use to create the VPC endpoint.
7. (Optional) To turn off private DNS, choose Additional settings, and then uncheck Enable Private DNS Name.
   Note: Private DNS is turned on by default.
8. For Subnets, select your subnets.
9. For Security groups, select the security groups that you want to associate with the endpoint network interfaces.
10. Choose Create endpoint.
11. Choose the Details tab, and then note of the Endpoint ID to use in the next section.

For more information, see Create a VPC endpoint.

Create a private API

Complete the following steps:

1. Open the API Gateway console.
2. Choose Create API.
3. For REST API Private, choose Build.
   Note: A private REST API is only available from within a VPC.
4. For API name, enter a name for your private API.
5. For VPC endpoint IDs, enter your VPC endpoint ID, and then choose Add.
6. Choose Create API.
7. Deploy your API to a stage.

For more information, see Create a private API.

Create a public API

Complete the following steps:

1. Open the API Gateway console.
2. Choose Create API.
3. For HTTP API or REST API, choose Build.
4. For API name, enter a name for your public API.
5. Choose Create API.

For more information, see Create an HTTP API.

Connect to public APIs with private DNS turned on

Important: Your VPC resources must have internet connectivity to connect to your public APIs.

To connect to public APIs with private DNS turned on, set up an edge-optimized custom domain names or Regional custom domain names. You can then invoke the API Gateway public API with the custom domain name, such as api.example.com. Connectivity to your private REST APIs continues to work through the private REST API endpoint.

If you want to connect from an on-premises network, then set up an Amazon Route 53 resolver inbound endpoint. To use the execute-api invoke URL, forward all the private DNS queries from your on-premises network to the inbound endpoint.

Connect to private APIs with private DNS turned off

Note: The default execute-api invoke URL can't connect to private REST APIs with private DNS turned off.

To connect to private APIs with private DNS turned off, create a private hosted zone for your custom domain in Route 53. In the private hosted zone, add an A record for your API identifier. Point the A record to the IP addresses of the interface VPC endpoint to use the default execute-api invoke URL of the private REST API.

Related information

Invoke a private API

Control and manage access to REST APIs in API Gateway

How do I access a private API Gateway API when the VPC endpoint uses an on-premises DNS?

Why do I get an HTTP "403 Forbidden" error when I try to connect to my API Gateway public APIs from a VPC?