I am trying to connect an AWS Private API Gateway to my VPC through a VPC Endpoint that already exists in my deployment stack, but when I check in the console I don't see a connection.
Below is some code snippets from my YML file.
I have pulled the VPC endpoint from SSM and have confirmed that this is the Endpoint ID. My VPE Endpoint ID comes up as vpce-XXXXXXXXXXXX in SSM under "APIGW"
Parameters:
TenantName:
Type: String
Profile:
Type: String
...
# VPC params for API GW
VPC:
Type: String
APIGW:
Type: String
I then make my Private API Gateway as follows. It contains one Lambda defined above this API.
PrivateApi:
Type: AWS::Serverless::Api
Properties:
Name: PrivateApi
StageName: v1
MethodSettings:
- HttpMethod: '*'
ResourcePath: /*/*/*
LoggingLevel: ERROR
ThrottlingBurstLimit: 5000
ThrottlingRateLimit: 10000
EndpointConfiguration: PRIVATE
DefinitionBody:
swagger: 2.0
info:
title: PrivateApi
x-amazon-apigateway-api-key-source: "HEADER"
schemes:
- https
x-amazon-apigateway-policy:
Version: "2012-10-17"
Statement:
-
Effect: "Allow"
Principal: "*"
Action:
- "execute-api:Invoke"
Resource: "execute-api:/*"
Condition:
StringEquals:
aws:sourceVpce: !Ref APIGW
paths:
/{proxy+}:
x-amazon-apigateway-any-method:
produces:
- application/json
parameters:
- name: proxy
in: path
required: true
type: string
x-amazon-apigateway-integration:
uri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${HandleSecurityRouter.Arn}/invocations
httpMethod: POST
type: aws_proxy
But if I look in the console after a successful deployment using the SAM tool, the API Gateway is not connected to any VPC endpoints.
Any help in getting this VPC endpoint to connect to my Private API Gateway with SAM would be much appreciated!
After making a version of what I needed in the console and turning it back into YML with the AWS "Export as Swagger" feature under "API"->Stages->"Stage"->Export, I found an undocumented or hard to find property of API Gateway swagger that needs to be added to link a Private Gateway to a VPC through a VPC endpoint.
What is needed is the following lines in your swagger:
DefinitionBody:
swagger: 2.0
...
x-amazon-apigateway-endpoint-configuration:
vpcEndpointIds:
- !Ref API-Gateway-ID
It worked for me adding the line below servers -> url -> x-amazon-apigateway-endpoint-configuration:
openapi: "3.0.2"
info:
title: "APIGW-TEST-01"
version: "1.0"
servers:
- url: "https://asdf.execute-api.us-east-1.amazonaws.com/{basePath}"
variables:
basePath:
default: "/test"
x-amazon-apigateway-endpoint-configuration:
vpcEndpointIds:
- "vpce-0asdf"
paths:
...