An internal service must provide an API only to clients in a VPC.
The API endpoint must not be reachable from the public internet.
Which architecture is most appropriate?
Use an API Gateway private REST API with an interface VPC endpoint to keep access on private network paths.
Detailed explanation
Keeping a URL secret does not restrict network reachability or prevent discovery.
Keeping a URL secret does not restrict network reachability or prevent discovery.
A public S3 bucket is not a private API endpoint for VPC clients.
A public S3 bucket is not a private API endpoint for VPC clients.
A private API is reachable through a VPC endpoint without requiring a public internet endpoint.
A private API is reachable through a VPC endpoint without requiring a public internet endpoint.
DNS provides name resolution and does not replace an API processing endpoint.
DNS provides name resolution and does not replace an API processing endpoint.
Check official documentation
Compare the following points with the official documentation.
API Gateway private APIとVPC Endpointの公式説明を確認する。
What to confirm
API公開範囲とVPC経路を同時に限定できる。
Key points
- Private REST API
- Interface VPC endpoint
- VPC-only access
Notes
- Environment: AWS公式API Gateway・VPCドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Private ingress
The endpoint type and VPC path jointly determine whether clients need the public internet.
DNS is not access control
A private name can help resolution, but the endpoint and policy still enforce access.