How to associate an ElasticIP to an API Gateway in AWS

amazon-web-services

I'd like to have an API gateway to act a proxy that talks to an External API (let's call it E-API) with an attached token, on behalf of my AWS resources (Lambda, EC2 etc).

But E-API only accepts requests from certain whitelisted IPs agreed upon beforehand.

So we got an Elastic IP, but I'm kinda stumped about how to associate the IP with my API Gateway: so that when it sends off a HTTP to the E-API, it identifies itself as emerging out of that Elastic IP.

I have tried poking around the settings for VPC and Route53 but need help on how I can move forward?

Best Answer

It's not possible to associate an Elastic IP address with an API Gateway.

However, even if it was possible, it would not solve your issue. This is because your executing code (either Lambda or an EC2-instance behind-the-scenes) is where your logic is running. It is from there that you want to have a fixed IP address that you can whitelist.

This is possible to do using a NAT Instance or NAT Gateway with an Elastic IP address.

Setup a VPC to run your code in.
Create a public subnet with a NAT instance or NAT gateway. Give this an Elastic IP address.
Create a private subnet that talks to the internet via the NAT gateway.
Configure your Lambda function(s) or your EC2 instances to execute in the private subnet.

If you do this, then all out-bound connections from your functions will exit from the NAT with the fixed IP address. You can then whitelist that Elastic IP address.

Related Solutions

AWS Gateway API: Multi-Region deployment from the same domain

Unfortunately, this is not currently possible. The primarily blocker here is CloudFront. MikeD@AWS provides the info on their forums:

When you create a custom domain name it creates an associated CloudFront distribution for the domain name and CloudFront enforces global uniqueness on the domain name.

If a CloudFront distribution with the domain name already exists, then the CreateCloudFrontDistribution will fail and API Gateway will return an error without saving the domain name or allowing you to define it's associated API(s).

Thus, there is currently (Jun 29, 2016) no way to get API Gateway in multiple regions to handle the same domain name.

AWS has no update on providing the needful since confirming existence of an open feature request on July 4, 2016. AWS Form thread for updates

HAProxy – Using as Reverse Proxy for AWS API Gateway

If you don't use HTTPS then CloudFront will return the 400 Bad Request¹ error because API Gateway doesn't support HTTP.

Adding ssl verify none enables HTTPS to the back-end, CloudFront just closes the connection, causing HAProxy to log the session state at disconnection as SC-- and return the local 503 Service Unavailable error.

The solution is indeed sending Server Name Identification (SNI). Otherwise, CloudFront's front-end doesn't know which SSL certificate to offer you -- the generic *.cloudfront.net wildcard cert, or the one for *.execute-api.ap-southeast-2.amazonaws.com or one of probably hundreds of thousands of other possibilities. That's what SNI does in this case -- it tells the server what name you're connecting to.

The solution -- this is a single line, shown as multiple lines for clarity:

server api-gateway 
       xxxxx.execute-api.ap-southeast-2.amazonaws.com:443
       ssl
       verify none
       sni str(xxxxx.execute-api.ap-southeast-2.amazonaws.com)

You have to use the str() string sample fetch here, because the sni server keyword expects a sample fetch expression (for cases where you wanted to use the incoming request's SNI, for example).

The problem in the question on the forum was not actually related to SNI -- that part of the configuration was correct. The problem there was that they failed to do what you already did correctly -- http-request set-header host ... so that CloudFront sees the correct Host: header.

Note also the advice on the forum that this is a "very bad idea" seems distinctly misplaced.

¹ 400 CloudFront -- in some cases -- returns "Bad Request" in the body but the actual HTTP status code is 403 which corresponds to Forbidden.

Best Answer

Related Solutions

AWS Gateway API: Multi-Region deployment from the same domain

HAProxy – Using as Reverse Proxy for AWS API Gateway

Related Topic