在 SAM (AWS IAC) 中将私有 API 网关连接到 VPC 的正确方法

Question

I am trying to connect an AWS Private API Gateway to my VPC through a VPC Endpoint that already exists in my deployment stack, but when I check in the console I don't see a connection.

Below is some code snippets from my YML file.

I have pulled the VPC endpoint from SSM and have confirmed that this is the Endpoint ID. My VPE Endpoint ID comes up as vpce-XXXXXXXXXXXX in SSM under "APIGW"

Parameters:
  TenantName:
    Type: String
  Profile:
    Type: String

  ...

  # VPC params for API GW
  VPC:
    Type: String
  APIGW:
    Type: String

I then make my Private API Gateway as follows. It contains one Lambda defined above this API.

  PrivateApi:
    Type: AWS::Serverless::Api
    Properties:
      Name: PrivateApi
      StageName: v1
      MethodSettings:
        - HttpMethod: '*'
          ResourcePath: /*/*/*
          LoggingLevel: ERROR
          ThrottlingBurstLimit: 5000
          ThrottlingRateLimit: 10000
      EndpointConfiguration: PRIVATE
      DefinitionBody:
        swagger: 2.0
        info:
          title: PrivateApi
        x-amazon-apigateway-api-key-source: "HEADER"
        schemes:
          - https
        x-amazon-apigateway-policy:
          Version: "2012-10-17"
          Statement:
            -
              Effect: "Allow"
              Principal: "*"
              Action:
                - "execute-api:Invoke"
              Resource: "execute-api:/*"


              Condition:
                StringEquals:
                  aws:sourceVpce: !Ref APIGW 


        paths:
          /{proxy+}:
            x-amazon-apigateway-any-method:
              produces:
              - application/json
              parameters:
              - name: proxy
                in: path
                required: true
                type: string
              x-amazon-apigateway-integration:
                uri:
                  Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${HandleSecurityRouter.Arn}/invocations
                httpMethod: POST
                type: aws_proxy

But if I look in the console after a successful deployment using the SAM tool, the API Gateway is not connected to any VPC endpoints.

Any help in getting this VPC endpoint to connect to my Private API Gateway with SAM would be much appreciated!

Answer 1

After making a version of what I needed in the console and turning it back into YML with the AWS "Export as Swagger" feature under "API"->Stages->"Stage"->Export, I found an undocumented or hard to find property of API Gateway swagger that needs to be added to link a Private Gateway to a VPC through a VPC endpoint.

What is needed is the following lines in your swagger:

      DefinitionBody:
        swagger: 2.0
        ...
        x-amazon-apigateway-endpoint-configuration:
          vpcEndpointIds:
            - !Ref API-Gateway-ID

Answer 2

It worked for me adding the line below servers -> url -> x-amazon-apigateway-endpoint-configuration :

openapi: "3.0.2"
info:
  title: "APIGW-TEST-01"
  version: "1.0"
servers:
- url: "https://asdf.execute-api.us-east-1.amazonaws.com/{basePath}"
  variables:
    basePath:
      default: "/test"
  x-amazon-apigateway-endpoint-configuration:
    vpcEndpointIds:
    - "vpce-0asdf"
paths:  
...