VPN, VPC Endpoint and privare REST API

Question

Hi

I have a private REST API Gateway endpoint. This one I need to access from on prem. So I have established a site-to-site vpn connection. Connectivity to my VPC is working fine. In order to access the private REST API I have assumed that I need to establish a VPC Endpoint interface which is associated with the Private REST API.

In the VPC there are no issues accessing the VPC endpoing using https://{restapi-id}.execute-api.{region}.amazonaws.com/{stage} or if I access the VPC endpoint URL and provide an x-apigw-api-id header.
Problem is that, the first where the restapi-id is included in the URL is not possible to resolve on prem, and using the resolvable vpc-endpoint URL it fails due to that CORS preflight request don't send x-apigw-api-id.
If I use postman to consume any of the configurations it works ok.

Nenne · Accepted Answer

I might have found the issue. It was a new vpce-id which was so similar that I didn't reflect over it. That in combination with command line history. :(

This is possible to resolve from both inside and outside of the VPC bbbbccccdd-vpce-000011112222aaaa7.execute-api.eu-west-1.amazonaws.com, where bbbbccccdd is the api-id and vpce-000011112222aaaa7 is the VPC Endpoint ID.

re:Post Agent · Answer

Your understanding of the setup is correct, but there are a few considerations and potential solutions for accessing your private REST API from on-premises:

1. DNS Resolution: The issue with resolving the API URL from on-premises is likely due to DNS resolution. To resolve this, you can set up a Route 53 private hosted zone in your VPC and create a DNS record for your API. Then, configure your on-premises DNS to forward queries for this domain to Route 53.

2. VPC Endpoint Configuration: Ensure that your VPC endpoint has private DNS enabled. This allows the API's DNS name to resolve to the private IP of the VPC endpoint within your VPC.

3. Custom Domain Name: Consider setting up a custom domain name for your private API. This provides a stable, vanity URL for your API that can be more easily managed across your network. You'll need an ACM certificate and a Route 53 private hosted zone for this.

4. CORS Configuration: For the CORS preflight issue, you need to configure CORS on your API Gateway. Ensure that the OPTIONS method is allowed and that the necessary headers (including x-apigw-api-id) are included in the Access-Control-Allow-Headers response.

5. Resource Policy: Make sure your API's resource policy allows access from your VPC endpoint. You may need to explicitly allow access from your on-premises IP range if it's not already covered.

6. Security Groups: Check that the security group associated with your VPC endpoint allows inbound traffic from your on-premises network.

If Postman works but browser-based access doesn't, it's likely a CORS issue. Focus on properly configuring CORS for your API, ensuring all necessary headers are allowed, and that the OPTIONS method is correctly set up.

Remember, when accessing the API from on-premises, you're essentially treating it as if you're inside the VPC, so the same access methods that work within the VPC should work from on-premises once DNS resolution and network routing are properly configured.
      
**Sources**  
[Internetwork traffic privacy - Amazon API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/security-traffic-privacy.html)  
[Implementing custom domain names for private endpoints with Amazon API Gateway | AWS Compute Blog](https://aws.amazon.com/blogs/compute/implementing-custom-domain-names-for-private-endpoints-with-amazon-api-gateway/)  
[Prioritize API security - AWS Serverless Multi-Tier Architectures with Amazon API Gateway and AWS Lambda](https://docs.aws.amazon.com/whitepapers/latest/serverless-multi-tier-architectures-api-gateway-lambda/prioritize-api-security.html)

VPN, VPC Endpoint and privare REST API

Add your answer

Relevant content