By using AWS re:Post, you agree to the Terms of Use
/Create API GW Websocket API that is only accessible from within a VPC./

Create API GW Websocket API that is only accessible from within a VPC.


Hi, I want to create Websocket API in the AWS APIGW, but, that it only only accessible from within a VPC (because I want to integrate it in with CloudFront, i.e., the authentication will be in the CloudFront using signed cookie or URL).

I could not find any documentation that do it.


1 Answers

API Gateway Websockets APIs do not support private APIs so you can't really prevent access to the API from any location. Saying that, you mention CloudFront as the way to access the API. If you use CloudFront, the requests are not routed via a VPC.

One way to achieve that only requests that came from CloudFront are handled by API Gateway is to add sone secret between CloudFront and API GW. This can be done by adding a new header with a specific value in CloudFront and create a Lambda Authorizer in API GW that verifies the value in the header.

answered 19 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions