API Gateway:Use API Gateway to access a backend service in a VPC

Prerequisites

• A VPC environment is created. For more information, see Create a VPC with an IPv4 CIDR block and Create a VPC with an IPv6 CIDR block.

• An Elastic Compute Service (ECS) instance is created. For more information, see Step 1: Create an ECS instance.

Process

Complete the following steps to configure API Gateway access to a VPC backend service:

• Create a VPC access authorization

• Create an API group

• Create an API

• Create an application and authorize the application to call the API

• Allow the egress IP addresses of API Gateway in a security group

• Debug the API

• Call the API

Create a VPC access authorization

Create a VPC access authorization to allow API Gateway to access your VPC.

1. Log on to the API Gateway console. In the top navigation bar, select a region. In the navigation pane on the left, choose Manage APIs > VPCs.

2. On the VPC Access Authorizations page, click Create Authorization in the upper-right corner.

3. In the Create VPC Access dialog box, specify the VPC Access Name, VPC Id, Instance ID or IP Address, and Port Number parameters.

   

   Note

   • You can specify a domain name in the Host field to access a vhost on an SLB or ECS instance.

   • In VPC Id, enter the ID of the VPC where your backend service resides. In Instance ID or IP Address, enter the instance ID or private IP address. You can find this information in the ECS instance details.

Create an API group

Create an API

1. Log on to the API Gateway console. In the top navigation bar, select a region. In the navigation pane on the left, choose Manage APIs > API Groups.

2. On the API Groups page, in the Actions column for the nginx-demo group you created, click Manage APIs.

3. On the APIs page, click Create API in the upper-right corner.

4. In the Basic Information step of the Create API wizard, configure the following parameters and click Next.

   Parameter	Example
   Group	nginx-demo
   API Name	nginx-test
   Security Authentication	Alibaba Cloud App
   AppCode Authentication	Enable AppCode Authentication (Header & Query)
   Signature Algorithm	HMAC_SHA256

   

5. In the Define API Request step, configure the following parameters and click Next.

   Parameter	Example
   Protocol	HTTP and HTTPS
   Request Path	/nginx
   HTTP Method	GET
   Request Mode	Pass-through

   

   Note

   This step defines how clients (web browsers, mobile apps, or business systems) request the API. In this example, Request Mode is set to Pass-through, which means API Gateway forwards requests to the VPC backend service without processing them.

6. In the Define Backend Service step, configure the following parameters and click Next.

   Parameter	Example
   Configuration Mode	Customize Backend Service
   Backend Service Type	VPC
   VPC Access Name	***-microservice
   Backend Request Path	/
   HTTP Method	GET
   Backend Service Timeout Period	10000

   

   Note

   This step configures the backend service type and URL. In this example, VPC is specified for Backend Service Type, the VPC access authorization you created earlier is specified for VPC Access Name, and a path is specified for Backend Request Path.

7. In the Define Response step, configure the parameters on the page as needed and then click Create.

   

   Note

   This step specifies response information for API documentation. You can set Response ContentType, Response Example, and Error Response Example. This example skips these settings. Click Create.

8. In the message that appears, click Publish.

   

9. In the Publish API dialog box that appears, set Environment to Release, enter remarks in the Remarks section, and then click Publish.

   

   Note

   API modifications take effect only after you publish the API to the corresponding environment. API Gateway provides three environments: Release, Pre, and Test.

Create an application and authorize the application to call the API

An application is the identity used to call an API. In the Create an API step, the authentication type is set to Alibaba Cloud App. After publishing the API, create and authorize an application to call it.

Allow the egress IP addresses of API Gateway in a security group

If the security group of your ECS instance does not allow all CIDR blocks over a specified port, add the egress IP addresses of the API Gateway instance where the API group resides to the security group.

1. Log on to the API Gateway console. In the navigation pane on the left, choose Manage APIs > API Groups. On the API Groups page, click the name of the API group that you created.

2. On the Group Details page, view the Instance Type parameter.

3. In the navigation pane on the left, choose Instances and Clusters > Shared Instances or Instances and Clusters > Dedicated Instances based on the instance type that you obtained. On the page that appears, scroll to the Outbound Addresses parameter of the instance based on the instance ID to view the egress IP addresses of the instance.

   

4. Log on to the ECS console. In the navigation pane on the left, choose Instances & Images > Instances. Click the created ECS instance to go to the details page. Click the Security Groups tab and click the security group that you want to manage. On the Security Group Details tab, click the Inbound tab and then click Quick Add. In the Quick Add dialog box, configure the egress IP addresses of API Gateway.

   

Debug the API

Use online debugging to verify that an API is correctly configured before calling it from clients.

1. Log on to the API Gateway console. In the navigation pane on the left, choose Call APIs > Debug.

2. On the Debug page, select the nginx-test API that you created, select Use AppCode as the Authentication Method, and then click Send Request. The response shown in the following figure indicates that the configuration is successful.

   

   If the debugging fails, see the following documents:

   • FAQ overview

   • Error codes

Call the API

For more information, see Client-based API calls.