Amazon API Gateway in front of ELB and ECS Cluster

amazon-web-services aws-api-gateway amazon-elb amazon-ecs
Ricardo García Martín picture Ricardo García Martín · Jan 31, 2017 · Viewed 26.7k times · Source

I'm trying to put an Amazon API Gateway in front of an Application Load Balancer, which balances traffic to my ECS Cluster, where all my microservices are deployed. The motivation to use the API Gateway is to use a custom authorizer through a lambda function.

System diagram

enter image description here

In Amazon words (https://aws.amazon.com/api-gateway/faqs/): "Proxy requests to backend operations also need to be publicly accessible on the Internet". This forces me to make the ELB public (internet-facing) instead of internal. Then, I need a way to ensure that only the API Gateway is able to access the ELB outside the VPC.

My first idea was to use a Client Certificate in the API Gatway, but the ELB doesn't seem to support it.

Any ideas would be highly appreciated!

Answer

Dylan Nicholson picture Dylan Nicholson · Oct 15, 2017

This seems to be a huge missing piece for the API gateway technology, given the way it's pushed. Not being able to call into an internal-facing server in the VPC severely restricts its usefulness as an authentication front-door for internet access. FWIW, in Azure, API Management supports this out of the box - it can accept requests from the internet and call directly into your virtual network which is otherwise firewalled off. The only way this seems to be possible under AWS is using Lambdas, which adds a significant layer of complexity, esp. if you need to support various binary protocols.

Related questions

How to pass a querystring or route parameter to AWS Lambda from Amazon API Gateway

for instance if we want to use GET /user?name=bob or GET /user/bob How would you pass both of these examples as a parameter to the Lambda function? I saw something about setting a "mapped from" in the …

Read More
Can an AWS Lambda function call another

I have 2 Lambda functions - one that produces a quote and one that turns a quote into an order. I'd like the Order lambda function to call the Quote function to regenerate the quote, rather than just receive it from …

Read More
Missing Authentication Token while accessing API Gateway?

I am trying to call a Lambda Function through AWS API Gateway. When I mention Authentication type NONE it works fine but API become public and anyone with url can access my API. To make API call secure, I am …

Read More