Cross Account to AWS Private API Gateway with 'ETIMEDOUT' error

Question

I have a service in AWS Account_1 which tries to invoke a AWS Private API Gateway in AWS Account_2. But its unsuccessful and throws ETIMEDOUT error

I tried whitelisting Account_1's user and role in Account_2 Private API gateway's resource policy with no luck.

{"code":"ETIMEDOUT","errno":"ETIMEDOUT","syscall":"connect","address":"xxx.xxx.xxx.xxx","port":443}

Answer 1

In order to access Private API from a cross account. Lets say Account A has Private API and Account B has VPC Endpoint

1. Make sure the VPC Endpoint and Private API both are in same region

2. The security group of AWS resource eg EC2 from where the request is made have a security group rule that allows TCP Port 443 outbound traffic to the interface VPC endpoint's IP address range or security group.

3. The interface VPC endpoint's security group in Account B is correctly configured. It must have a rule that allows TCP Port 443 inbound traffic from the IP address range or security group of the AWS resource that's making requests.

4. VPC Endpoint is whitelisted in resource policy of Private API in Account A

See more for troubleshooting private API here - https://cloudnamaste.com/troubleshooting-api-gateway-private-api/