7

We have multiple EC2 instances hosting our micro-services. The autoscaling group of servers has an ELB. All traffic is routed via the AWS API Gateway. The problem is that the ELB has its HTTPS port open to the world.

How to protect our servers, so that traffic is only allowed to pass through API Gateway?

Improve this question

2 Answers 2

Reset to default
6

Since November 2017, it is now possible to directly interact with servers in a VPC \o/

See:

Improve this answer
1
  • 2
    You may try adding some more information from aws doc in case aws move their doc so future reader can search on a specific term to find it back if the link break.
    – Tensibai
    Commented Dec 20, 2017 at 20:05
4

The best protection for your servers if you don't want to expose their HTTPS to the world would be to isolate them in a VPC.

However, API Gateway can't be configured to directly interact with servers in a VPC/subnet (yet). In order to get around that limitation, you can proxy your traffic from the API Gateway through AWS Lambda to reach the VPC. AWS blog has an excellent blog post that explains exactly how to do so.

Isolating your servers in a VPC will be more secure than keeping them on the public Internet and trying to build something to detect if the traffic is legitimate (coming from API gateway).

Improve this answer
3
  • Proxying through Lambda would get extremely expensive for any moderately active API. There must be better options than that.
    – Evgeny Zislis
    Commented Mar 3, 2017 at 7:49
  • 1
    Extremely expensive? How so? Can you share your usage statistics?
    – Alexandre
    Commented Mar 3, 2017 at 7:59
  • 1
    Say 150m executions per month, up to 400ms per request. Selecting the least performant 128mb Lambda type. The calculator at s3.amazonaws.com/lambda-tools/pricing-calculator.html shows about ~$150/month. Actually not extremely expensive, but not negligible either.
    – Evgeny Zislis
    Commented Mar 3, 2017 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.