
<p>
  This blog shows how to create a private REST API, and then will consume by the
  EC2 Linux Instance. It will use the AWS API Gateway to build a private REST
  API and use the existing VPC endpoint to communicate from EC2 to REST API. The
  traffic from EC2 to REST API will not go through the public internet.&nbsp;
</p>
<p>
  The scenario below assumes AWS EC2 will consume private REST API, and the REST
  API will integrate with lambda functions. There are few steps this blog as pre
  requirement
</p>
<ul>
  <li>Already set up an AWS account.</li>
  <li>
    You already set up VPC, Public Subnet, and Security Group with port 80 is
    open.
  </li>
  <li>
    You have an EC2 instance running under the public subnet and use the VPC.
  </li>
</ul>
<h2>Create Lambda Function</h2>
<p>
  First, we'll just create a simple Lambda function because later the Private
  REST API will call the Lambda function. So go to the AWS Lambda and create a
  function and we can leave everything as default is fine, because create the
  Lambda function is not the main purpose here.&nbsp;&nbsp;
</p>
<h2>Create Endpoints</h2>
<p>
  Here, we'll need to create endpoints at VPC, at the VPC page's left panel
  click the Endpoints and then click the Create Endpoint button. We'll need to
  create VPC endpoints because later the Private REST API will need.
</p>
<p>
  On the Create Endpoints page, choose the AWS services for Service category.
  For Service Name, search for <strong>executing</strong>, you should be able to
  find something similar as c<strong
    >om.amazonaws.us-west-1.execute-api,</strong
  >
  then choose the service.
</p>
<p>
  For the VPC, choose the VPC you desire to use as the private REST API. Also,
  choose the corresponding subnet for that VPC.&nbsp;
</p>
<p>
  Check the Enable DNS name, and security group then click the Create Endpoint
  button.
</p>
<p>
  Make sure to memo the Endpoint ID, because will need it later for the private
  REST API.
</p>
<h2>Create Private REST API&nbsp;</h2>
<p>
  Now, we'll create a private REST API by using the API Gateway. Go to the API
  Gateway, click the build under REST API Private.&nbsp;
</p>
<p>
  Choose the New API, Enter any name for the API Name. Change the Endpoint Type
  to Private.
</p>
<p>
  At the VPC Endpoint IDs, enter the VPC Endpoint ID we have created before,
  click the Create API button to create API.&nbsp;
</p>
<h3>Create Resource</h3>
<p>
  For creating REST API, first, we'll need to create resources, click the
  Actions and click create a resource, enter any resource name and resource
  path, then click create resource button.
</p>
<h3>Create Method</h3>
<p>
  Click Actions then click create method, choose Any, make sure the Integration
  type is Lambda Function and select the Lambda you create before and click
  save.
</p>
<h3>Test the API</h3>
<p>Test the API to make sure the response is what is expected.&nbsp;</p>
<h3>Publish API</h3>
<p>
  Click Deploy API, enter Deployment Stage, enter any name and then deploy the
  API. Now API is deployed and you should see some URL as follow. Please memo
  the <strong>x4aiqshkvj</strong>, will later use this to create a custom
  policy.
</p>
<p>https://x4aiqshkvj.execute-api.us-west-1.amazonaws.com/test</p>
<h2>Create Resource Policy</h2>
<p>
  We'll need to create a resource policy at the API, open the Resource Policy
  then replace the following vpceID with the endpoint ID we create
  earlier.&nbsp;
</p>
<pre class="language-markup"><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "execute-api:/*",
            "Condition": {
                "StringNotEquals": {
                    "aws:sourceVpce": "vpceID"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "execute-api:/*"
        }
    ]
}</code></pre>
<h2>Create Custom Policy and Attach to EC2 Role</h2>
<p>
  We'll need to create a custom policy for EC2 to execute the API gateway, go to
  the IAM Policies and create a new policy as follow.&nbsp; You'll need to
  replace your account ID, region, API key, and specify API scope. Once is
  custom policy is finish, make sure this policy is attached to the EC2.
</p>
<pre class="language-markup"><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "execute-api:Invoke"
            ],
            "Resource": [
                "arn:aws:execute-api:us-west-1:{AWS Account ID}:fqmufdbru6/*/GET/test"
            ]
        }
    ]
}</code></pre>
<p></p>
<h2>Test Private REST API via EC2</h2>
<p>
  To test the private API we just created, first put the API to the browser and
  make sure DNS can't reach it.&nbsp;
</p>
<p>
  Now, in the next test, we'd like to access the private link within the VPC to
  make sure the API is working.&nbsp;
</p>
<p>
  Let's ssh into the EC2 which using the same VPC as the private VPC API. Run
  following at your EC2, assume running on the Linux Amazon AMI, if this
  response is the same result from your Lambda, then you are successfully
  testing the private rest API is working.
</p>
<pre
  class="language-markup"
><code>curl https://xxx.execute-api.us-west-1.amazonaws.com/test</code></pre>
<h2>Conclusion</h2>
<p>
  Building the private REST API with API Gateway is a little more work compared
  to the public REST API, but once you follow the step it should be fine, and
  your request won't go through the public internet and can run within your VPC.
  That means if you use any other AWS Service and running the same VPC and you
  can access the same private API.
</p>


This blog shows how to create a private REST API, and then will consume by the EC2 Linux Instance. It will use the AWS API Gatewayto build a private REST API and use the existing VPC endpoint to communicate from EC2 to REST API. The traffic from EC2 to RESTAPI will not go through the public internet.

How to Build Private REST API with Lambda and Used By EC2


<p>
  This blog shows how to build a simple API Gateway REST API with AWS Lambda.
  We'll also use AWS Lambda versioning and aliases to switch to a different
  version by using Node.js.
</p>
<p>
  At here, we'll create a Lambda function by using Node.js, then we're going to
  create 2 versions of it and each will return a different value. Finally will
  create an alias as <strong>prod</strong> which will map version 1,
  furthermore, we'll switch from version 1 to version 2 and check the result.
  For the API gateway, will create a public REST API and connect to the Lambda
  we just create.
</p>
<h2>Setup AWS Account</h2>
<p>
  First, you'll need to have an AWS account, if you don't you can create an AWS
  Free Tier account which will be free of charge for a one-year period. However
  the AWS Lambda and API Gateway are very cheap, for instance, $0.20 per 1 M
  requests to use Lambda, for API Gateway, the first 333 million is $3.5,
  which's pretty cheap if you think about you don't have to host the
  server.&nbsp;
</p>
<h2>Create Lambda Function</h2>
<h3>Create Lambda function from scratch</h3>
<p>
  Here, go to the Lambda and clicked create function, then choose the Author
  from scratch.
</p>
<p>
  Enter the function name, for example, let's use
  <strong>myLambdaTest</strong>.
</p>
<p>Choose Node.js 14.x, so we'll be using Node.js and use version 14.</p>
<p>
  You can skip the entire Advance Setting, but if you need to use your own VPC,
  subnet, or security group you can use the advance setting to modify the
  setting you prefer.
</p>
<p>
  You should be able to see your Lambda function, click the index.js, and should
  be able to see the default code snippet provide by AWS.
</p>
<pre class="language-javascript"><code>exports.handler = async (event) =&gt; {
    // TODO implement
    const response = {
        statusCode: 200,
        body: JSON.stringify('Hello from Lambda!'),
    };
    return response;
};</code></pre>
<h3>Publish new version</h3>
<p>
  click publish the new version and enter the description, this then will become
  our <strong>version 1</strong>.
</p>
<h3>Create alias</h3>
<p>
  Go to the lambda function, click action then click Create an alias. Enter the
  alias name, here we'll use <strong>prod</strong>. For the version, let's
  choose version 1. Now, here is the important thing for this blog, we notice
  our lambda alias <strong>prod</strong> is mapping to version 1 now.&nbsp;
</p>
<p>
  Also, check the lambda function ARN, you should see something as follows.
  Please note this, please later we'll use this at the API gateway.&nbsp;
</p>
<pre
  class="language-markup"
><code>arn:aws:lambda:us-west-1:1234567890:function:myLambdaTest:prod</code></pre>
<h3>Modify the Lambda and publish a new version</h3>
<p>
  Now, here we'll go back to the Lambda modify the response as follows. We
  basically just modify the response, after the change click deploys and then
  click action to publish a new version.
</p>
<pre class="language-javascript"><code>exports.handler = async (event) =&gt; {
    // TODO implement
    const response = {
        statusCode: 200,
        body: JSON.stringify('Hi'),
    };
    return response;
};</code></pre>
<p>
  At this point, we have 2 versions of our Lambda, one returns the '<strong
    >Hello from Lambda</strong
  >' which is version 1 another is returning '<strong>Hi</strong>' which is
  version 2, and alias <strong>prod</strong> is using version 1.&nbsp;
</p>
<h2>Create API Gateway</h2>
<p>
  Here, we'll create public REST API and use the Lambda we just created as
  back-end.&nbsp;
</p>
<p>Go to the API Gateway, then click REST API's build button.</p>
<p>Choose New API and enter API name.&nbsp;</p>
<h3>Create Resource</h3>
<p>at the API, click Actions, and then click Create Resource.</p>
<p>Enter the resource name and resource path.</p>
<h3>Create Method</h3>
<p>
  At the resource, we just created, click actions then click create method, here
  we'll create an HTTP method for the resource we have. We'll use Any for now,
  but you can specify to get, post, put or delete.&nbsp;
</p>
<p>
  On the setup page, make sure the integration type is Lambda Function, at the
  Lambda function field choose the Lambda name we just created earlier. You
  should see <strong>myLambdaTest</strong>, nowhere is the important part,
  instead of using this name we would apply the alias <strong>prod</strong>, so
  we change the name as follows.&nbsp;
</p>
<pre class="language-markup"><code>myLambdaTest:prod</code></pre>
<p>
  click ok, so this API gateway is integrated with lambda's alias
  <strong>prod</strong> now. The reason, we're doing it in this way is you can
  have control of what version to use for API Gateway to execute the Lambda.
  &nbsp;
</p>
<h2>Test API Gateway</h2>
<p>
  Now, our API gateway is pretty much finished, let's click the test button to
  test the API gateway.&nbsp;
</p>
<p>
  Click the Test, choose the Method as Get, you'll see the response shows 'Hello
  from Lambda!", that's our lambda's version 1.
</p>
<p>
  Now, we'd like to update our lambda's alias's prod to point to version
  2.&nbsp;
</p>
<p>
  Go back to the Lambda function, click the Aliases tab and choose the
  <strong>prod</strong> then click Edit.&nbsp;
</p>
<p>
  At the Edit alias window, change Version 1 to version 2 and click the save
  button.
</p>
<p>
  Now, go back to the API Gateway and test the API gateway again, you'll notice
  the response body is 'Hi' now. So use lambda will have the flexibility of how
  you can deploy the Lambda function, you can do blue/green deployment or split
  the load to each version.&nbsp;
</p>
<h2>Publish API Gateway</h2>
<p>
  Click the Actions then click the Deploy API. At Deployment Stage, choose New
  Stage. Enter the Stage name then click the Deploy button.&nbsp;
</p>
<p>
  Now, at the stage editor page, you should have a URL, run the URL will run the
  Lambda function behind the scene and give you the same result.&nbsp;
</p>
<h2>Conclusion</h2>
<p>
  This blog just simply shows how to create REST API with Lambda function and
  how to switch Lambda version with aliases.&nbsp;
</p>


This blog shows how to build a simple API Gateway REST API with AWS Lambda. We'll also use AWS Lambda versioning and aliases toswitch to a different version by using Node.js.

Category APIGateway

How to Build Private REST API with Lambda and Used By EC2

How to Use API Gateway with AWS Lambda Versioning and Aliases