Answers: <p>The best protection for your servers if you don't want to expose their HTTPS to the world would be to isolate them in <a href="https://aws.amazon.com/vpc/" rel="nofollow noreferrer">a VPC</a>.</p>
  
  <p>However, API Gateway can't be configured to directly interact with servers in a VPC/subnet (yet). In order to get around that limitation, you can proxy your traffic from the API Gateway through AWS Lambda to reach the VPC. AWS blog has an <a href="https://aws.amazon.com/blogs/compute/using-api-gateway-with-vpc-endpoints-via-aws-lambda/" rel="nofollow noreferrer">excellent blog post</a> that explains exactly how to do so.</p>
  
  <p>Isolating your servers in a VPC will be more secure than keeping them on the public Internet and trying to build something to detect if the traffic is legitimate (coming from API gateway).</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-03-03T07:49:57.097Z
Answers: Proxying through Lambda would get extremely expensive for any moderately active API. There must be better options than that.
Answers: Evgeny Zislis
Answers: CC BY-SA 3.0
Answers: 2017-03-03T07:59:45.347Z
Answers: Extremely expensive? How so? Can you share your usage statistics?
Answers: Alexandre
Answers: CC BY-SA 3.0
Answers: 2017-03-03T08:57:08.443Z
Answers: Say 150m executions per month, up to 400ms per request. Selecting the least performant 128mb Lambda type. The calculator at https://s3.amazonaws.com/lambda-tools/pricing-calculator.html shows about ~$150/month. Actually not extremely expensive, but not negligible either.
Answers: Evgeny Zislis
Answers: CC BY-SA 3.0
Answers: 2017-03-03T07:10:16.173Z
Answers: 2017-03-03T07:10:16.173Z
Answers: Alexandre
Answers: <p>Since November 2017, it is now possible to directly interact with servers in a VPC \o/</p>
  
  <p>See: </p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway">https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway</a></li>
  <li><a href="http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html" rel="noreferrer">http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html</a></li>
  </ul>
  
Answers: CC BY-SA 3.0
Answers: 2017-12-20T20:05:56.513Z
Answers: You may try adding some more information from aws doc in case aws move their doc so future reader can search on a specific term to find it back if the link break.
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-12-20T16:56:06.147Z
Answers: 2017-12-20T16:56:06.147Z
Answers: Maxime Thoonsen
Body: <p>We have multiple EC2 instances hosting our micro-services. The autoscaling group of servers has an ELB. All traffic is routed via the AWS API Gateway. The problem is that the ELB has its HTTPS port open to the world.</p>
  
  <p>How to protect our servers, so that traffic is only allowed to pass through API Gateway?</p>
  
Tags: <amazon-web-services><security>
Title: How to only allow API Gateway requests to reach our EC2 instances
UserDisplayName: Evgeny Zislis
ThreadText: # How to only allow API Gateway requests to reach our EC2 instances
  
  (Asked by: username_0 on 2017-03-03)
  
  We have multiple EC2 instances hosting our micro-services. The autoscaling group of servers has an ELB. All traffic is routed via the AWS API Gateway. The problem is that the ELB has its HTTPS port open to the world.
  
  How to protect our servers, so that traffic is only allowed to pass through API Gateway?
  
  **Tags:** amazon-web-services, security
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2017-12-20. Score: 6 | Accepted answer
  
  Since November 2017, it is now possible to directly interact with servers in a VPC \o/
  
  See:
  
  * <https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway>
  * <http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html>
  
  > **Comments:**
  > **username_3**: You may try adding some more information from aws doc in case aws move their doc so future reader can search on a specific term to find it back if the link break.  
  
  ---
  
  ### Answer by username_1 on 2017-03-03. Score: 4
  
  The best protection for your servers if you don't want to expose their HTTPS to the world would be to isolate them in [a VPC](https://aws.amazon.com/vpc/).
  
  However, API Gateway can't be configured to directly interact with servers in a VPC/subnet (yet). In order to get around that limitation, you can proxy your traffic from the API Gateway through AWS Lambda to reach the VPC. AWS blog has an [excellent blog post](https://aws.amazon.com/blogs/compute/using-api-gateway-with-vpc-endpoints-via-aws-lambda/) that explains exactly how to do so.
  
  Isolating your servers in a VPC will be more secure than keeping them on the public Internet and trying to build something to detect if the traffic is legitimate (coming from API gateway).
  
  > **Comments:**
  > **username_0**: Proxying through Lambda would get extremely expensive for any moderately active API. There must be better options than that.  
  > **username_1**: Extremely expensive? How so? Can you share your usage statistics?  
  > **username_0**: Say 150m executions per month, up to 400ms per request. Selecting the least performant 128mb Lambda type. The calculator at https://s3.amazonaws.com/lambda-tools/pricing-calculator.html shows about ~$150/month. Actually not extremely expensive, but not negligible either.  
  
  ---
  
  