How to secure REST api gateway to be accessible within the network

Question

I have created a REST api gateway which would invoke a lambda function. While im accessing the invoke url its accessible over the internet. but i need to restrict it such a way that if i provide a Domain name it should resolve the url internally and accessible only internally. When ever its accessed over internet publicly it should give error.
Can some one guide on the architecture what can be done here to restrict it.

Jesus Bernal · Answer

I believe you are looking for [private REST APIs](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html) in Amazon API Gateway. A few important considerations:
 
* Private APIs live in an AWS-owned account and you need to create a [VPC endpoint ](https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html) to access it. 
* Use [Resource Policies](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-resource-policies.html) to restrict how the API can be invoked.
* You can use [custom domain names](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-custom-domains.html) with private APIs. This [blog post](https://aws.amazon.com/blogs/compute/implementing-custom-domain-names-for-private-endpoints-with-amazon-api-gateway/) provides a good overview of the steps involved.

How to secure REST api gateway to be accessible within the network

Add your answer

Relevant content