AWS apigateway documentation change
Summary
Complete restructuring of the documentation to focus on VPC link V2 integrations. Added detailed procedures for creating/updating private integrations with ALB/NLB using Console, CLI, and OpenAPI. Removed legacy VPC link V1 content and NLB-specific setup instructions.
Security assessment
The changes add explicit documentation about using HTTPS for secure communication between API Gateway and VPC resources, including certificate verification requirements. However, there's no evidence of addressing a specific security vulnerability. The added HTTPS guidance improves security documentation but doesn't reference any security incident.
Diff
diff --git a/apigateway/latest/developerguide/set-up-private-integration.md b/apigateway/latest/developerguide/set-up-private-integration.md index 4c0aea238..8bf1f2be2 100644 --- a//apigateway/latest/developerguide/set-up-private-integration.md +++ b//apigateway/latest/developerguide/set-up-private-integration.md @@ -5 +5 @@ -# Private integrations for REST APIs in API Gateway +Create a private integrationUpdate a private integration @@ -7 +7 @@ -The API Gateway private integration makes it simple to expose your HTTP/HTTPS resources within an Amazon VPC for access by clients outside of the VPC. To extend access to your private VPC resources beyond the VPC boundaries, you can create an API with private integration. You can control access to your API by using any of the [authorization methods](./apigateway-control-access-to-api.html) that API Gateway supports. +# Set up a private integration @@ -9 +9 @@ The API Gateway private integration makes it simple to expose your HTTP/HTTPS re -To create a private integration, you must first create a Network Load Balancer. Your Network Load Balancer must have a [listener](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-listeners.html) that routes requests to resources in your VPC. To improve the availability of your API, ensure that your Network Load Balancer routes traffic to resources in more than one Availability Zone in the AWS Region. Then, you create a VPC link that you use to connect your API and your Network Load Balancer. After you create a VPC link, you create private integrations to route traffic from your API to resources in your VPC through your VPC link and Network Load Balancer. +To create a private integration with an Application Load Balancer or Network Load Balancer, you create an HTTP proxy integration, specify the [VPC link V2](./apigateway-vpc-links-v2.html) to use, and provide the ARN of an Network Load Balancer or an Application Load Balancer. By default, private integration traffic uses the HTTP protocol. To use HTTPS, specify an [`uri`](https://docs.aws.amazon.com/apigateway/latest/api/API_PutIntegration.html#apigw-PutIntegration-request-uri) that contains a secure server name, such as `https://example.com:443/test`. For a complete tutorial on how to create a REST API with a private integration, see [Tutorial: Create a REST API with a private integration](./getting-started-with-private-integration.html). @@ -11 +11 @@ To create a private integration, you must first create a Network Load Balancer. -###### Note +## Create a private integration @@ -13 +13 @@ To create a private integration, you must first create a Network Load Balancer. -The Network Load Balancer and API must be owned by the same AWS account. +The following procedure shows how to create a private integration that connects to a load balancer by using a VPC link V2. @@ -15 +15 @@ The Network Load Balancer and API must be owned by the same AWS account. -With the API Gateway private integration, you can enable access to HTTP/HTTPS resources within a VPC without detailed knowledge of private network configurations or technology-specific appliances. +AWS Management Console @@ -17 +16,0 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re -###### Topics @@ -19 +18 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re - * [Set up a Network Load Balancer for API Gateway private integrations](./set-up-nlb-for-vpclink-using-console.html) +For a tutorial on how to create a private integration see, [Tutorial: Create a REST API with a private integration](./getting-started-with-private-integration.html). @@ -21 +20 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re - * [Grant permissions for API Gateway to create a VPC link](./grant-permissions-to-create-vpclink.html) +AWS CLI @@ -23 +21,0 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re - * [Set up an API Gateway API with private integrations using the AWS CLI](./set-up-api-with-vpclink-cli.html) @@ -25 +23 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re - * [Set up API with private integrations using OpenAPI](./set-up-api-with-vpclink-using-swagger.html) +The following [put-integration](https://docs.aws.amazon.com/cli/latest/reference/latest/api/API_PutIntegration.html) command creates a private integration that connects to a load balancer by using a VPC link V2: @@ -27 +24,0 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re - * [API Gateway accounts used for private integrations](./set-up-api-with-vpclink-accounts.html) @@ -28,0 +26,10 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re + aws apigateway put-integration \ + --rest-api-id abcdef123 \ + --resource-id aaa000 \ + --integration-target 'arn:aws:elasticloadbalancing:us-east-2:111122223333:loadbalancer/app/myLoadBalancerName/1234567891011' \ + --uri 'https://example.com:443/path' \ + --http-method GET \ + --type HTTP_PROXY \ + --integration-http-method GET \ + --connection-type VPC_LINK \ + --connection-id bbb111 @@ -29,0 +37 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re +Instead of directly providing the connection ID, you can use a stage variable instead. When you deploy your API to a stage, you set the VPC link V2 ID. The following [put-integration](https://docs.aws.amazon.com/cli/latest/reference/latest/api/API_PutIntegration.html) command creates a private integration using a stage variable for the VPC link V2 ID: @@ -31,0 +40,122 @@ With the API Gateway private integration, you can enable access to HTTP/HTTPS re + aws apigateway put-integration \ + --rest-api-id abcdef123 \ + --resource-id aaa000 \ + --integration-target 'arn:aws:elasticloadbalancing:us-east-2:111122223333:loadbalancer/app/myLoadBalancerName/1234567891011' \ + --uri 'https://example.com:443/path' \ + --http-method GET \ + --type HTTP_PROXY \ + --integration-http-method GET \ + --connection-type VPC_LINK \ + --connection-id "\${stageVariables.vpcLinkV2Id}" + +Make sure to double-quote the stage variable expression (${stageVariables.vpcLinkV2Id}) and escape the $ character. + +OpenAPI + + +You can set up an API with the private integration by importing the API's OpenAPI file. The settings are similar to the OpenAPI definitions of an API with HTTP integrations, with the following exceptions: + + * You must explicitly set `connectionType` to `VPC_LINK`. + + * You must explicitly set `connectionId` to the ID of a `VpcLinkV2` or to a stage variable referencing the ID of a `VpcLinkV2`. + + * The `uri` parameter in the private integration points to an HTTP/HTTPS endpoint in the VPC, but is used instead to set up the integration request's `Host` header. + + * The `uri` parameter in the private integration with an HTTPS endpoint in the VPC is used to verify the stated domain name against the one in the certificate installed on the VPC endpoint. + + + + +You can use a stage variable to reference the `VpcLinkV2` ID. Or you can assign the ID value directly to `connectionId`. + +The following JSON-formatted OpenAPI file shows an example of an API with a VPC link as referenced by a stage variable (`${stageVariables.vpcLinkIdV2}`): + + + { + "swagger": "2.0", + "info": { + "version": "2017-11-17T04:40:23Z", + "title": "MyApiWithVpcLinkV2" + }, + "host": "abcdef123.execute-api.us-west-2.amazonaws.com", + "basePath": "/test", + "schemes": [ + "https" + ], + "paths": { + "/": { + "get": { + "produces": [ + "application/json" + ], + "responses": { + "200": { + "description": "200 response", + "schema": { + "$ref": "#/definitions/Empty" + } + } + }, + "x-amazon-apigateway-integration": { + "responses": { + "default": { + "statusCode": "200" + } + }, + "uri": "https://example.com:443/path", + "passthroughBehavior": "when_no_match", + "connectionType": "VPC_LINK", + "connectionId": "${stageVariables.vpcLinkV2Id}", + "integration-target": "arn:aws:elasticloadbalancing:us-east-2:111122223333:loadbalancer/app/myLoadBalancerName/1234567891011", + "httpMethod": "GET", + "type": "http_proxy" + } + } + } + }, + "definitions": { + "Empty": { + "type": "object", + "title": "Empty Schema" + } + } + } + +## Update a private integration + +The following example updates the VPC link V2 for a private integration. + +AWS Management Console + + +###### To update a private integration + + 1. Sign in to the API Gateway console at [https://console.aws.amazon.com/apigateway](https://console.aws.amazon.com/apigateway). + + 2. Choose a REST API with a private integration. + + 3. Choose the resource and method that uses a private integration. + + 4. On the **Integration request tab** , under the **Integration request settings** , choose **Edit**. + + 5. You can edit the setting of your private integration. If you are currently using a VPC link V1, you can change your VPC link to a VPC link V2. + + 6. Choose **Save**. + + 7. Redeploy your API for the changes to take effect. + + + + +AWS CLI + + +The following [update-integration](https://docs.aws.amazon.com/cli/latest/reference/latest/api/API_PutIntegration.html) command updates a private integration to use a VPC link V2: + + + aws apigateway update-integration \ + --rest-api-id a1b2c3d4e5 \ + --resource-id a1b2c3 \ + --http-method GET \ + --patch-operations "[{\"op\":\"replace\",\"path\":\"/connectionId\",\"value\":\"pk0000\"}, {\"op\":\"replace\",\"path\":\"/uri\",\"value\":\"http://example.com\"}, {\"op\":\"replace\",\"path\":\"/integrationTarget\",\"value\":\"arn:aws:elasticloadbalancing:us-east-2:111122223333:loadbalancer/app/myLoadBalancerName/1234567891011\"}]" + @@ -38 +168 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -HTTP integration +VPC links V2 @@ -40 +170 @@ HTTP integration -Set up a Network Load Balancer for private integrations +Private integration using VPC links V1 (legacy)