Skip to content

API Gateway HTTP API with VPC Link to ECS Service Returns "Internal Server Error"

0

Issue Description

I'm trying to set up an API Gateway HTTP API with VPC Link to connect directly to an ECS service using CloudMap service discovery (without an NLB), following the architecture described in this AWS blog post .

When I access my ECS service directly via its private IP (10.0.4.92), it returns a successful response:

curl http://10.0.4.92

{"success":true,"data":"Hello World!","meta":{"timestamp":"2025-07-10T15:18:51.855Z","path":"/","duration":1}}

However, when I try to access it through the API Gateway endpoint, I get an "Internal Server Error":

curl https://s47d139oy9.execute-api.ca-central-1.amazonaws.com/

{"message":"Internal Server Error"}

My Setup

  • API Gateway HTTP API (ID: s47d139oy9)
  • VPC Link (ID: v11emi)
  • CloudMap service (ARN: arn:aws:servicediscovery:ca-central-1:555907822687:service/srv-jtxdxjqpkygbiffi)
  • ECS service running on port 80 (accessible directly via private IP)

What I've Tried

  1. Created an integration with the CloudMap service ARN:
aws apigatewayv2 create-integration \
  --api-id s47d139oy9 \
  --integration-type HTTP_PROXY \
  --integration-method ANY \
  --connection-type VPC_LINK \
  --connection-id v11emi \
  --payload-format-version 1.0 \
  --integration-uri arn:aws:servicediscovery:ca-central-1:555907822687:service/srv-jtxdxjqpkygbiffi \
  --region ca-central-1
  1. Created routes with different paths:
aws apigatewayv2 create-route \
  --api-id s47d139oy9 \
  --route-key 'ANY /' \
  --target "integrations/7hhjg48" \
  --region ca-central-1
  1. Deployed the API:
aws apigatewayv2 create-deployment \
  --api-id s47d139oy9 \
  --stage-name '$default' \
  --region ca-central-1
  1. Tried different path configurations (/, /test, /{proxy+})
  2. Verified that the ECS service responds correctly when accessed directly
  3. Checked security groups to ensure they allow traffic between components
  4. Enabled access logs but couldn't find detailed error information

What I Don't Want to Do

I specifically don't want to use a Network Load Balancer (NLB) between the API Gateway and ECS service. I want to follow the architecture in the blog post that uses CloudMap service discovery directly.

Questions

  1. What could be causing the "Internal Server Error" when the ECS service works fine when accessed directly?
  2. Are there any specific configurations or settings I'm missing for the API Gateway HTTP API with VPC Link and CloudMap service discovery?
  3. How can I get more detailed error information from the API Gateway HTTP API to troubleshoot this issue?
  4. Is there a working example of this architecture that I can reference?

Any help or guidance would be greatly appreciated!

1 Answer
0

When encountering an "Internal Server Error" with API Gateway connecting to an ECS service through a VPC Link, there are several potential causes and troubleshooting steps to consider.

First, it's important to understand that when you create a VPC link, API Gateway provisions Elastic Network Interfaces to access your VPC. This provisioning process can take several minutes to complete. If you're trying to use the VPC link immediately after creation, it might not be fully provisioned yet, resulting in the internal server error you're experiencing.

For troubleshooting this issue:

  1. Verify that your VPC link has completed provisioning. Check the status in the API Gateway console to ensure it's "Available" and not still in the "Pending" state.

  2. Ensure that the security groups associated with your VPC link allow traffic from API Gateway to your ECS service on the required port (port 80 in your case).

  3. Check that your integration URI is correctly formatted. When using CloudMap service discovery, make sure the ARN format is correct and that the service is properly registered.

  4. Verify that your ECS service is properly configured to accept traffic from the VPC link. The security groups for your ECS tasks should allow inbound traffic from the security group associated with the VPC link.

  5. For more detailed error information, you can enable execution logs for your API Gateway. This will provide more context about what's happening when the request is processed.

  6. Consider checking CloudWatch Logs for any error messages related to your API Gateway or ECS service.

  7. Verify that your API Gateway integration is correctly set up with the HTTP_PROXY integration type and the proper connection to your VPC link.

If you're still experiencing issues, you might want to temporarily set up a Network Load Balancer as an intermediate step to help isolate whether the problem is with the API Gateway configuration, the VPC link, or the CloudMap service discovery.
Sources
API Gateway + VPC Private Link : Interna Server Error | AWS re:Post
Tutorial: Create an HTTP API with a private integration to an Amazon ECS service - Amazon API Gateway
Tutorial: Create a REST API with a private integration - Amazon API Gateway

answered a year ago

  • I already asked Amazon Q to help check their status. it hadn't found any issue. I don't want to use NLB

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.