How to create IP-protected endpoints with API Gateway and Lambda

If you haven’t been paying close attention you might have missed the API Gateway announcement for resource policies. It later played a key role in supporting API Gateway private endpoints – a way to put your API inside a private VPC.

To configure resource policies with the Serverless framework, you need to upgrade to v1.28.0 or later. If you want to restrict access to the GET /index.html endpoint to the IP 217.128.123.174, you need the following.

provider:
  name: aws
  runtime: nodejs8.10
  resourcePolicy:
    - Effect: Allow
      Principal: "*"
      Action: execute-api:Invoke
      Resource:
        - execute-api:/*/GET/index.html
      Condition:
        IpAddress:
          aws:SourceIp:
            - 217.128.123.174

Nice and easy!

There are a couple of things to note:

  • You can implement IP blacklisting by changing Effect to Deny.
  • If you change the resource policy in the API Gateway console, it won’t take effect until you deploy the API. No such worries with the serverless framework, as sls deploy would deploy the API for you as part of the CloudFormation update.
  • You can mix IP and IAM conditions for different endpoints in the same API. But, IP and IAM conditions don’t work for a private API, which is not publicly accessible and is required for VPC private endpoints.
  • When you access the API from EC2 or ECS, you need to whitelist the public IP of the instance, or the NAT Gateway if the instance is not associated with a public IP.

After you set up IP whitelisting on the endpoint, you will get an error like this if you attempt to access it from an IP that has not been whitelisted.

{
  "Message": "User: anonymous is not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:eu-central-1:********3770:io75qg1rvf/test/GET/index.html"
}


Yan Cui

I’m an AWS Serverless Hero and the author of Production-Ready Serverless. I have run production workload at scale in AWS for nearly 10 years and I have been an architect or principal engineer with a variety of industries ranging from banking, e-commerce, sports streaming to mobile gaming. I currently work as an independent consultant focused on AWS and serverless.

You can contact me via Email, Twitter and LinkedIn.

Hire me.


 

Come learn about operational BEST PRACTICES for AWS Lambda: CI/CD, testing & debugging functions locally, logging, monitoring, distributed tracing, canary deployments, config management, authentication & authorization, VPC, security, error handling, and more.

You can also get 40% off the face price with the code ytcui.

Get Your Copy