<p>The best protection for your servers if you don't want to expose their HTTPS to the world would be to isolate them in <a href="https://aws.amazon.com/vpc/" rel="nofollow noreferrer">a VPC</a>.</p>

<p>However, API Gateway can't be configured to directly interact with servers in a VPC/subnet (yet). In order to get around that limitation, you can proxy your traffic from the API Gateway through AWS Lambda to reach the VPC. AWS blog has an <a href="https://aws.amazon.com/blogs/compute/using-api-gateway-with-vpc-endpoints-via-aws-lambda/" rel="nofollow noreferrer">excellent blog post</a> that explains exactly how to do so.</p>

<p>Isolating your servers in a VPC will be more secure than keeping them on the public Internet and trying to build something to detect if the traffic is legitimate (coming from API gateway).</p>

CC BY-SA 3.0
2017-03-03T07:49:57.097Z
Proxying through Lambda would get extremely expensive for any moderately active API. There must be better options than that.
Evgeny Zislis
CC BY-SA 3.0
2017-03-03T07:59:45.347Z
Extremely expensive? How so? Can you share your usage statistics?
Alexandre
CC BY-SA 3.0
2017-03-03T08:57:08.443Z
Say 150m executions per month, up to 400ms per request. Selecting the least performant 128mb Lambda type. The calculator at https://s3.amazonaws.com/lambda-tools/pricing-calculator.html shows about ~$150/month. Actually not extremely expensive, but not negligible either.
Evgeny Zislis
CC BY-SA 3.0
2017-03-03T07:10:16.173Z
2017-03-03T07:10:16.173Z
Alexandre
<p>Since November 2017, it is now possible to directly interact with servers in a VPC \o/</p>

<p>See: </p>

<ul>
<li><a href="https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway">https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway</a></li>
<li><a href="http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html" rel="noreferrer">http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html</a></li>
</ul>

CC BY-SA 3.0
2017-12-20T20:05:56.513Z
You may try adding some more information from aws doc in case aws move their doc so future reader can search on a specific term to find it back if the link break.
Tensibai
CC BY-SA 3.0
2017-12-20T16:56:06.147Z
2017-12-20T16:56:06.147Z
Maxime Thoonsen
<p>We have multiple EC2 instances hosting our micro-services. The autoscaling group of servers has an ELB. All traffic is routed via the AWS API Gateway. The problem is that the ELB has its HTTPS port open to the world.</p>

<p>How to protect our servers, so that traffic is only allowed to pass through API Gateway?</p>

<amazon-web-services><security>
How to only allow API Gateway requests to reach our EC2 instances
Evgeny Zislis
# How to only allow API Gateway requests to reach our EC2 instances

(Asked by: username_0 on 2017-03-03)

We have multiple EC2 instances hosting our micro-services. The autoscaling group of servers has an ELB. All traffic is routed via the AWS API Gateway. The problem is that the ELB has its HTTPS port open to the world.

How to protect our servers, so that traffic is only allowed to pass through API Gateway?

**Tags:** amazon-web-services, security


---

## 2 answers

### Answer by username_2 on 2017-12-20. Score: 6 | Accepted answer

Since November 2017, it is now possible to directly interact with servers in a VPC \o/

See:

* <https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway>
* <http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html>

> **Comments:**
> **username_3**: You may try adding some more information from aws doc in case aws move their doc so future reader can search on a specific term to find it back if the link break.  

---

### Answer by username_1 on 2017-03-03. Score: 4

The best protection for your servers if you don't want to expose their HTTPS to the world would be to isolate them in [a VPC](https://aws.amazon.com/vpc/).

However, API Gateway can't be configured to directly interact with servers in a VPC/subnet (yet). In order to get around that limitation, you can proxy your traffic from the API Gateway through AWS Lambda to reach the VPC. AWS blog has an [excellent blog post](https://aws.amazon.com/blogs/compute/using-api-gateway-with-vpc-endpoints-via-aws-lambda/) that explains exactly how to do so.

Isolating your servers in a VPC will be more secure than keeping them on the public Internet and trying to build something to detect if the traffic is legitimate (coming from API gateway).

> **Comments:**
> **username_0**: Proxying through Lambda would get extremely expensive for any moderately active API. There must be better options than that.  
> **username_1**: Extremely expensive? How so? Can you share your usage statistics?  
> **username_0**: Say 150m executions per month, up to 400ms per request. Selecting the least performant 128mb Lambda type. The calculator at https://s3.amazonaws.com/lambda-tools/pricing-calculator.html shows about ~$150/month. Actually not extremely expensive, but not negligible either.  

---

