
## Table of Contents

- [Introduction](#introduction)
- [Create Lambda Function](#create-lambda-function)
- [Create Endpoints](#create-endpoints)
- [Create Private REST API](#create-private-rest-api)
- [Create Resource Policy](#create-resource-policy)
- [Create Custom Policy and Attach to EC2 Role](#create-custom-policy-and-attach-to-ec2-role)
- [Test Private REST API via EC2](#test-private-rest-api-via-ec2)
- [Conclusion](#conclusion)

## Introduction

This blog shows how to create a private REST API that will be consumed by an
EC2 Linux Instance. It uses the AWS API Gateway to build a private REST API
and the existing VPC endpoint to communicate from EC2 to the REST API. The
traffic from EC2 to the REST API will not go through the public internet.

The scenario below assumes AWS EC2 will consume a private REST API, and the
REST API will integrate with Lambda functions. There are a few prerequisites
for this blog:

- You have already set up an AWS account.

- You have already set up a VPC, Public Subnet, and Security Group with port 80
  open.

- You have an EC2 instance running under the public subnet using the VPC.

## Create Lambda Function

First, we'll create a simple Lambda function because later the Private REST
API will call it. Go to AWS Lambda and create a function. We can leave
everything as default since creating the Lambda function is not the main
purpose here.

## Create Endpoints

Here, we'll need to create endpoints at VPC. On the VPC page's left panel,
click Endpoints and then click the Create Endpoint button. We need to create
VPC endpoints because the Private REST API will require them.

On the Create Endpoints page, choose AWS services for the Service category.
For Service Name, search for **execute-api**. You should be able to find
something similar to **com.amazonaws.us-west-1.execute-api**,
then choose the service.

For the VPC, choose the VPC you want to use for the private REST API. Also,
choose the corresponding subnet for that VPC.

Check Enable DNS name, select the security group, and then click the Create
Endpoint button.

Make sure to note down the Endpoint ID, because you will need it later for the
private REST API.

## Create Private REST API

Now, we'll create a private REST API by using the API Gateway. Go to the API
Gateway and click Build under REST API Private.

Choose New API, enter any name for the API Name, and change the Endpoint Type
to Private.

At the VPC Endpoint IDs field, enter the VPC Endpoint ID we created before,
then click the Create API button.

### Create Resource

For the REST API, first we'll need to create resources. Click Actions and then
click Create Resource. Enter any resource name and resource path, then click
the Create Resource button.

### Create Method

Click Actions, then click Create Method. Choose Any, make sure the Integration
type is Lambda Function, select the Lambda you created before, and click Save.

### Test the API

Test the API to make sure the response is what you expect.

### Publish API

Click Deploy API, enter a Deployment Stage name, and then deploy the API. Now
the API is deployed and you should see a URL like the following. Please note
down the API ID (e.g., `x4aiqshkvj`), as you will use it later to create a
custom policy.

https://x4aiqshkvj.execute-api.us-west-1.amazonaws.com/test

## Create Resource Policy

We'll need to create a resource policy for the API. Open the Resource Policy
and replace **vpceID** with the endpoint ID we created earlier.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "execute-api:/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": "vpceID"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "execute-api:/*"
        }
    ]
}
```

## Create Custom Policy and Attach to EC2 Role

We'll need to create a custom policy for EC2 to execute the API Gateway. Go to
IAM Policies and create a new policy as follows. You'll need to replace your
account ID, region, API key, and specify the API scope. Once the custom policy
is finished, make sure it is attached to the EC2 instance's role.

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "execute-api:Invoke"
            ],
            "Resource": [
                "arn:aws:execute-api:us-west-1:{AWS Account ID}:fqmufdbru6/*/GET/test"
            ]
        }
    ]
}
```

## Test Private REST API via EC2

To test the private API we just created, first enter the API URL in a browser
and confirm that DNS can't reach it from outside the VPC.

Now, for the next test, we want to access the private link from within the VPC
to make sure the API is working.

SSH into the EC2 instance that is using the same VPC as the private API. Run
the following command on your EC2 instance (assuming it is running Amazon Linux
AMI). If the response matches the result from your Lambda function, then you
have successfully confirmed that the private REST API is working.

```
curl https://xxx.execute-api.us-west-1.amazonaws.com/test
```

## Conclusion

Building a private REST API with API Gateway requires a little more work
compared to a public REST API, but once you follow the steps, it should be
straightforward. Your requests won't go through the public internet and will
run within your VPC. That means if you use any other AWS service running in the
same VPC, you can access the same private API.


This blog shows how to create a private REST API that will be consumed by an EC2 Linux Instance. It uses the AWS API Gateway to build a private REST API and the existing VPC endpoint to communicate from EC2 to the REST API. The traffic from EC2 to the REST API will not go through the public internet.

How to Build Private REST API with Lambda and Used By EC2


## Table of Contents

1. [Introduction](#introduction)
2. [Setup AWS Account](#setup-aws-account)
3. [Create Lambda Function](#create-lambda-function)
4. [Create API Gateway](#create-api-gateway)
5. [Test API Gateway](#test-api-gateway)
6. [Publish API Gateway](#publish-api-gateway)
7. [Conclusion](#conclusion)

## Introduction

This blog shows how to build a simple API Gateway REST API with AWS Lambda.
We'll also use AWS Lambda versioning and aliases to switch to a different
version by using Node.js.

Here, we'll create a Lambda function by using Node.js, then we're going to
create 2 versions of it and each will return a different value. Finally, we will
create an alias called **prod** which will map to version 1.
Furthermore, we'll switch from version 1 to version 2 and check the result.
For the API Gateway, we will create a public REST API and connect it to the Lambda
we just created.

## Setup AWS Account

First, you'll need to have an AWS account. If you don't, you can create an AWS
Free Tier account which will be free of charge for a one-year period. However,
AWS Lambda and API Gateway are very cheap. For instance, Lambda costs $0.20 per 1M
requests, and for API Gateway, the first 333 million requests cost $3.50,
which is pretty cheap when you consider you don't have to host the
server.

## Create Lambda Function

### Create Lambda Function from Scratch

Here, go to Lambda and click Create function, then choose Author
from scratch.

Enter the function name. For example, let's use
**myLambdaTest**.

Choose Node.js 14.x, so we'll be using Node.js version 14.

You can skip the entire Advanced Setting, but if you need to use your own VPC,
subnet, or security group, you can use the advanced setting to modify the
configuration you prefer.

You should be able to see your Lambda function. Click index.js, and you should
be able to see the default code snippet provided by AWS.

```
exports.handler = async (event) => {
    // TODO implement
    const response = {
        statusCode: 200,
        body: JSON.stringify('Hello from Lambda!'),
    };
    return response;
};
```

### Publish New Version

Click Publish new version and enter the description. This will then become
our **version 1**.

### Create Alias

Go to the Lambda function, click Actions, then click Create an alias. Enter the
alias name. Here we'll use **prod**. For the version, let's
choose version 1. Now, here is the important thing for this blog: we notice
our Lambda alias **prod** is mapping to version 1 now.

Also, check the Lambda function ARN. You should see something as follows.
Please note this down, as we'll use it later at the API Gateway.

```
arn:aws:lambda:us-west-1:1234567890:function:myLambdaTest:prod
```

### Modify the Lambda and Publish a New Version

Now, here we'll go back to the Lambda and modify the response as follows. We
basically just modify the response. After the change, click Deploy and then
click Actions to publish a new version.

```
exports.handler = async (event) => {
    // TODO implement
    const response = {
        statusCode: 200,
        body: JSON.stringify('Hi'),
    };
    return response;
};
```

At this point, we have 2 versions of our Lambda. One returns **'Hello from Lambda!'** which is version 1, and the other returns **'Hi'** which is
version 2. The alias **prod** is using version 1.

## Create API Gateway

Here, we'll create a public REST API and use the Lambda we just created as the
back-end.

Go to API Gateway, then click the REST API Build button.

Choose New API and enter the API name.

### Create Resource

At the API, click Actions, and then click Create Resource.

Enter the resource name and resource path.

### Create Method

At the resource we just created, click Actions, then click Create Method. Here
we'll create an HTTP method for the resource we have. We'll use Any for now,
but you can specify GET, POST, PUT, or DELETE.

On the setup page, make sure the integration type is Lambda Function. At the
Lambda Function field, choose the Lambda name we created earlier. You
should see **myLambdaTest**. Now here is the important part:
instead of using this name, we would apply the alias **prod**, so
we change the name as follows:

```
myLambdaTest:prod
```

Click OK, so this API Gateway is now integrated with Lambda's alias
**prod**. The reason we're doing it this way is so you can
have control of what version the API Gateway uses to execute the Lambda.

## Test API Gateway

Now, our API Gateway is pretty much finished. Let's click the Test button to
test the API Gateway.

Click Test, choose the Method as GET, and you'll see the response shows 'Hello
from Lambda!'. That's our Lambda's version 1.

Now, we'd like to update our Lambda alias prod to point to version 2.

Go back to the Lambda function, click the Aliases tab, choose
**prod**, and then click Edit.

At the Edit alias window, change from version 1 to version 2 and click the Save
button.

Now, go back to the API Gateway and test it again. You'll notice
the response body is 'Hi' now. Using Lambda aliases gives you the flexibility of how
you can deploy the Lambda function. You can do blue/green deployment or split
the load across each version.

## Publish API Gateway

Click Actions, then click Deploy API. At Deployment Stage, choose New
Stage. Enter the stage name, then click the Deploy button.

Now, at the stage editor page, you should have a URL. Running the URL will execute the
Lambda function behind the scenes and give you the same result.

## Conclusion

This blog simply shows how to create a REST API with a Lambda function and
how to switch Lambda versions with aliases.


This blog shows how to build a simple API Gateway REST API with AWS Lambda. We'll also use AWS Lambda versioning and aliases to switch to a different version by using Node.js.

APIGateway

How to Build Private REST API with Lambda and Used By EC2

How to Use API Gateway with AWS Lambda Versioning and Aliases