Specify Host Header when invoke a custom domain name for private API

My questions are:

1. When invoke a private custom domain name for private APIs, is it the default behavior of a private API to always require a host header with the id of the API? (Developer Guide doesn't seem to state that)
2. If the above is true, is there a workaround to invoke private custom domain name for private APIs without having to specify the Host header.

Background information: I have created a private API using the below instructions. https://docs.aws.amazon.com/apigateway/latest/developerguide/private-api-tutorial.html

As Amazon API Gateway now supports Custom Domain Name for private REST APIs, I want to try to call the created private API using custom domain name api.aws.internal.sample.com https://aws.amazon.com/about-aws/whats-new/2024/11/amazon-api-gateway-custom-domain-name-private-rest-apis/?nc1=h_ls Note: this is for for testing purpose so we are using a self-signed certificate and imported it to ACM.

We did the set up for Custom Domain Names and Route 53 following the below instructions. https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-custom-domains-tutorial.html However, when trying to invoke the private custom domain name, the curl command returns 403 error. Using curl command with Host header returns the expected 200 status.

For reference, below are the curl results: ■curl without Host headers -> 403 curl -vk https://api.aws.internal.sample.com/test/hello

• Host api.aws.internal.sample.com:443 was resolved.
• IPv6: (none)
• IPv4: 10.0.{}.{}
• Trying 10.0.{}.{}:443...
• Connected to api.aws.internal.sample.com (10.0.{}.{}) port 443
• ALPN: curl offers h2,http/1.1 ////
• SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 / secp256r1 / rsaEncryption
• ALPN: server did not agree on a protocol. Uses default.
• Server certificate: /////
• SSL certificate verify result: self-signed certificate (18), continuing anyway.
• Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
• using HTTP/1.x

GET /test/hello HTTP/1.1 Host: api.aws.internal.sample.com User-Agent: curl/8.5.0 Accept: /

< HTTP/1.1 403 Forbidden < Server: Server ///// < Content-Type: application/json < Content-Length: 42 < Connection: keep-alive ///// < x-amzn-ErrorType: MissingAuthenticationTokenException /////

• Connection #0 to host api.aws.internal.sample.com left intact {"message":"Missing Authentication Token"}

■curl with Host header -> 200 curl -vk https://api.aws.internal.sample.com/test/hello -H "Host: {api-id}.execute-api.{region-id}.amazonaws.com" ////// < HTTP/1.1 200 OK < Server: Server < Date: //// < Content-Type: application/json < Content-Length: 27 < Connection: keep-alive ////

• Connection #0 to host api.aws.internal.sample.com left intact Reached Lambda

■Additional information

1. API Gateway Resource Policy: Allow execute-api:Invoke for connection through API Gateway's VPC Endpoint

   "Action": "execute-api:Invoke", "Resource": "arn:aws:execute-api:{region-id}:{account-id}:{api-id}/*/GET/hello", "Condition": { "StringEquals": { "aws:SourceVpce": "{AWS VPC Endpoint}"

2. Resource Policy of Custom Domain names (API Gateway): Allow execute-api:Invoke for only connection from API Gateway's VPC Endpoint

   "Effect": "Deny", "Principal": "", "Action": "execute-api:Invoke", "Resource": "execute-api:/", "Condition": { "StringNotEquals": { "aws:SourceVpce": "{VPC Endpoint ID}"