What is the recommended way to enforce path-based routing for resources in other accounts?

Yes, you can implement path-based routing for resources across multiple AWS accounts. There are a few approaches to solve this:

Option 1: HTTP API with VPC Links

For HTTP APIs, you can create VPC Links in account A (where your API Gateway resides) that connect to your services in accounts B and C. The key is that the VPC Link must exist in the same account as the API Gateway. You have three options for the VPC Link target:

1. Application Load Balancer (ALB)
2. Network Load Balancer (NLB)
3. AWS Cloud Map

You would then set up path-based routing in your API Gateway to direct traffic to the appropriate VPC Link based on the URL path.

Option 2: AWS PrivateLink with API Gateway

You can use AWS PrivateLink to establish private connectivity between your accounts. In this setup:

1. Create a VPC endpoint (Interface Endpoint) for API Gateway in account A
2. Set up Private REST APIs in accounts B and C
3. Add resource policies to the Private APIs to allow access from the VPC endpoint in account A
4. Configure Route 53 private hosted zones to properly resolve the Private API Gateway endpoints

Option 3: AWS Migration Hub Refactor Spaces

For a more managed solution, AWS Migration Hub Refactor Spaces can help orchestrate the necessary AWS infrastructure for routing API calls across multiple accounts. It automatically configures API Gateway, Network Load Balancer, and IAM policies across your AWS accounts. You would only need to configure the service endpoint and the route, and Refactor Spaces would handle the API Gateway-Lambda integration and creation of Lambda resource policies.

Option 4: Cross-account ALB with VPC Link

You can create an ALB in account A that points to the VPC endpoint private IP addresses of the PrivateLink connections to accounts B and C. Then create a VPC Link in account A that connects to this ALB. This allows your API Gateway in account A to route to services in accounts B and C based on path patterns.

For all these options, ensure you have proper IAM permissions set up to allow cross-account access, and that security groups and route tables are configured to allow traffic between the VPCs and endpoints.
Sources
Can a vpc Link be used for a HTTP API (Account A) to trigger a private rest api in account B through a VPC endpoint using Cloud Map | AWS re:Post
Can we associate Centralize VPC endpoint (execute API) with Private Rest API gateway | AWS re:Post
HTTP API - Best Practices for Designing Amazon API Gateway Private APIs and Private Integration
Strangler fig pattern - AWS Prescriptive Guidance

You're absolutely right, this is a common setup, but the path to get it working across accounts isn’t obvious.

The key point is: API Gateway does not support using VPC Endpoints or PrivateLink directly as integration targets. That’s why you’re seeing the Invalid hostname. VPC endpoints cannot be referenced directly error.

****Recommended Architecture for Cross-Account Path-Based Routing:

1. Keep API Gateway and domain (e.g., company.com) in Account A

2. Deploy your ECS services behind NLBs in accounts B and C

3. Use AWS Resource Access Manager (RAM) to share those NLBs (and their VPCs) with Account A

4. In Account A:

   --> Create VPC Links to the shared NLBs from B and C

   --> Create path-based routes in API Gateway pointing to the correct VPC Link for each service

              --> /api/v1/* → service in Account B
   
               --> /api/v1/web/* and / → service in Account C
   

5. Use a custom domain mapping in API Gateway to serve company.com

This avoids the need for PrivateLink and works cleanly with API Gateway’s supported integration types.

Note: This model scales well if you add more service accounts later You can add authentication, WAF, caching, or rate limiting at the API Gateway layer

API Gateway does not support integrating with VPC links in a different account. The solution is to use an NLB in your own account that somehow connects to the service in the other account.

One option is to front the other services with a private API and then create a VPC Endpoint to API Gateway in your own account. Forward the NLB to that Endpoint, which can access private APIs in other accounts. You can find information about it here, specifically in the Regional API Gateway to private API Gateway cross-account section. You can also find information here.

Another option is to route the NLB to the a LB in the other account by using VPC peering or VPC Endpoints with Endpoint Service.