AWS: Securing Internal APIs : A Deep Dive into REST API Security with AWS API Gateway and Microservices Integration Challenges
REST API Security | AWS API Gateway | Microservices Problem Statement We built a web application and some APIs for core functionalities of the application hosted in AWS Public Cloud. This is an internal application, and the API endpoints should be private, whereas the APIs are resolved outside the Enterprise network with the default endpoint generated in API Gateway. Hence, there is a need for a solution to set the API private. Impact Analysis The Web application is hosted in S3 as static hosting. The S3 bucket is set to private with the VPC-Endpoint policy as per the Client’s infrastructure standards. As per the current design, the application connects via an API Gateway and an internal ALB to the Java Microservices hosted in ECS containers in a private VPC. Current Integration Flow: Web client → React App (S3) → API Gateway → Internal ALB → ECS (Java Services). The current design uses AWS API Gateway with HTTP integration, which is public. Hence, we thought simply switching the integ...