Seeking Guidance on Configuring Internal IPs and VPC Endpoints for Multiple API Gateways

Question

Dear Community,

I am reaching out with a specific implementation requirement. Our setup necessitates the use of multiple API Gateways, and we also need to make each API Gateway accessible via one or more VPC Endpoints for use in a Site-to-Site VPN.

According to the documentation and current configuration, I am encountering challenges. Specifically, I am limited by the constraint that only one VPC Endpoint can be used to invoke an API Gateway via a single domain (execute-api). When attempting to add the domain to another VPC Endpoint, it indicates that the domain is already defined in a different VPC Endpoint.

Consolidating all events into a single API Gateway is not feasible for us. We have similar stages across multiple API Gateways, and creating a structure to distinguish which service to invoke becomes exceedingly complex, especially when multiple developers are modifying the same API Gateway.

Could you please advise on the following:

1. Is it possible to configure multiple internal IP addresses to invoke different API Gateways via multiple VPC Endpoints?
2. Can a single VPC Endpoint be used to invoke multiple API Gateways?
3. Do you have any recommendations or suggestions for managing this setup effectively?

Thank you for your assistance.

Best regards,

Didier_Durand · Answer

Hi,

I think that this article presents an architecture that is somewhat close (not exactly identical) to what you're trying to achieve: https://medium.com/@satyajit.samantaray/centralize-access-using-vpc-interface-endpoints-to-access-aws-services-across-multiple-vpcs-using-a586c846b48

It may provide you some inspiration to refine your current design.

Best,

Didier

Riku_Kobayashi · Answer

Hello.

> Is it possible to configure multiple internal IP addresses to invoke different API Gateways via multiple VPC Endpoints?

Sorry if I didn't understand your question correctly.  
If you enable private DNS for the VPC endpoint, the API Gateway's DNS name will be converted to the VPC endpoint's IP address from within the VPC, so I think there was no need to configure a VPC endpoint for each API Gateway.

For example, when you deploy API Gateway, the following API endpoints will be issued.  
At this time, by enabling the private DNS name of the VPC endpoint, accessing the following API endpoint from within the VPC will access the private IP address of the VPC endpoint.  
Therefore, if you have two API Gateways as shown below and access each API endpoint from within the VPC, there will be no problem.  
https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html  
```
# API No.1
https://xxxxxxabcd.execute-api.ap-northeast-1.amazonaws.com/dev

# API No.2
https://xxxxxxefgh.execute-api.ap-northeast-1.amazonaws.com/dev
```

> Can a single VPC Endpoint be used to invoke multiple API Gateways?

As answered in the question above, it is possible to access multiple API Gateways with one VPC endpoint.  
When accessing API Gateway from a VPC via a VPC endpoint, if you enable private DNS, you can access it without setting "x-apigw-api-id" in the header.

> Do you have any recommendations or suggestions for managing this setup effectively?

If you set up a VPC endpoint and enable private DNS, you will be able to access only the private API Gateway from within the VPC and not the public API Gateway.  
If you also need access to the public API Gateway, disable the private DNS of the VPC endpoint, and set "x-apigw-api-id" in the header to access the private API Gateway via the VPC endpoint. Please access at.  
Specifically, the access method is as follows.  
```
curl https://vpce-XXXXXXXXXXXXX1234-XXXXXXXX.execute-api.ap-northeast-1.vpce.amazonaws.com/dev -H'x-apigw-api-id:XXXXXXabcd'
```

Seeking Guidance on Configuring Internal IPs and VPC Endpoints for Multiple API Gateways

Relevant content