AWS: how to restrict access to API gateway from Amplify app?

Question

I have an Amplify app which I'd like to be the only one allowed to call an API gateway.

What's the best way to achieve that?

It seems possible to make the gateway private to a single VPC - but it seems like AWS Amplify app can't be placed inside any single VPC .

Are there other ways? Can I whitelist based on arn? IP? Other options?

Answer 1

AFAIK, VPC support is currently not available out of the box (may be in the future).

Some workarounds I've used are:

• Whitelist the API gateway only to your IP address
• Integrate private API gateway + Cloudfront and place WAF in front of it

REF: https://github.com/aws-amplify/amplify-hosting/issues/12